WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's usual that WordPress stores comment author name and email in the user's browser cookies, so next time the visitor has to comment, they have their name and email already filled in automatically.

My question is:

Is it possible for WordPress to store a visitor's comment cookies on two computers at different locations, but probably using the same ISP?

I'm asking this because I've seen someone else's name and email address stored in the comment form of a WordPress powered blog I was reading. My computer is password protected and nobody used it except me. And this happened not once, not twice but many times (every time a random unknown name and email). Even I've seen a "Your comment is waiting moderation" message.

And since I believed every browser maintains it's cookies for its own, this behavior is strange to me.



Property    Value
Name        comment_author_b4f88879dbf70af24980db38c9197684
Value       Emma
Host        example.tld
Path        /
Expires     Fri, 20 Dec 2013 12:56:16 GMT
Secure      No
HttpOnly    No

Name        comment_author_email_b4f88879dbf70af24980db38c9197684
Value       email%40server.co.uk
Host        example.tld
Path        /
Expires     Fri, 20 Dec 2013 12:56:16 GMT
Secure      No
HttpOnly    No
share|improve this question
+1, but I've never seen this before. Could you show us some example from your dev tools (I mean the cookie and it's values). – kaiser Jan 7 '13 at 7:37
@kaiser do you mean cookie property and its value? See my edit in the above question. – Muhannad Jan 7 '13 at 7:42
Yeah, those cookies that seem to magically appear and it's values. – kaiser Jan 7 '13 at 7:43
@kaiser: I edited my question. – Muhannad Jan 7 '13 at 7:49
Very kool - if all users would be like that :) One more question: Could you replace that with a real domain, so we could try it ourself? As I said, I've never seen that happening before. – kaiser Jan 7 '13 at 7:51
up vote 4 down vote accepted

The cookies are fine.

enter image description here

The secret is caching. The blog owner has set up a server side output caching that doesn’t stop when someone sends as cookie. It should – as you can see, because caching pages with personal data is … odd.

Lesson: Don’t cache personalized output.

share|improve this answer
Thanks toscho. The site is cached by the host provider as it seems. – Muhannad Jan 7 '13 at 12:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.