WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to extend the cookies of a subdomain.domain.com to all of the domain.com's subdomains (.domain.com in cookie terms).

I am trying to minimize the impact of this transition. It seems that flipping the switch with define('COOKIE_DOMAIN', '.domain.com'); in wp-config leaves the user in a state of limbo -- their cookie is good enough to validate, so it won't move to the new domain scope.

Any ideas on how I can transition cookies from .subdomain.domain.com to .domain.com with minimal impact on users?

Here's the code I've been failing and flailing with. It attempts to validate the old cookies when a bad hash is detected (from changing AUTH_KEY in wp-config.php) and then tries to re-validate and send them back to where they came from:

function do_report_bad_hash( $cookie_elements ) {

    if( isset( $_COOKIE['wordpress_logged_in_'] ) ) {
        $user_id = wp_validate_auth_cookie( urldecode( $_COOKIE['wordpress_logged_in_']), 'logged_in' );

        setcookie( 'wordpress_logged_in_', '', 0, '/', '.subdomain.domain.com', false, true ); 
        unset( $_COOKIE['wordpress_logged_in_'] );

        setcookie( 'wordpress_', '', 0, '/', '.subdomain.domain.com', false, true ); 
        unset( $_COOKIE['wordpress_'] );

        if ( $user_id !== false ) {


            $redirect = ( strpos($_SERVER['REQUEST_URI'], '/options.php') && wp_get_referer() ) ? wp_get_referer() : $proto . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

            header("Location: $redirect");    



add_action('auth_cookie_bad_hash', 'do_report_bad_hash', 11, 1 );
share|improve this question
I'm no expert but is the problem that you're setting then unsetting the cookie in the next line or are cookies domain dependent? – BandonRandon Apr 21 '11 at 23:59
up vote 2 down vote accepted

This answer may help. To quote:

The basic code you need here is this in the wp-config file:

define('LOGGED_IN_COOKIE', 'login_cookie_name');
define('COOKIE_DOMAIN', '.example.com');
define('COOKIEHASH', 'random_hash_here');

Put that in the config across multiple sites, set the keys and salts to be the same, and you'll have login cookies that work across the domain and subdomains.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.