3

Im trying to figure out how can I change names to cookies that wordpress is setting for example on login.

wordpress_test_cookie = sitename_test_cookie

or/ and

 wordpress_logged_in = sitename_test_cookie
  • 1
    Any specific reason for this? – Pieter Goosen Sep 8 '15 at 10:27
5

Check out the wp_cookie_constants() and ms_cookie_constants() functions, to see available cookies.

We can try this in the wp-config.php file:

// Here we just simulate how it's done in the core
define( 'COOKIEHASH',           md5( 'http://example.tld' )    ); 

// Then we override the cookie names:
define( 'USER_COOKIE',          'wpse_user_'      . COOKIEHASH );
define( 'PASS_COOKIE',          'wpse_pass_'      . COOKIEHASH );
define( 'AUTH_COOKIE',          'wpse_'           . COOKIEHASH );
define( 'SECURE_AUTH_COOKIE',   'wpse_sec_'       . COOKIEHASH );
define( 'LOGGED_IN_COOKIE',     'wpse_logged_in_' . COOKIEHASH );
define( 'TEST_COOKIE',          'wpse_test_cookie'             );

or using PHP 5.6+ :

// Then we override the cookie names:
const USER_COOKIE        = 'wpse_user_'      . COOKIEHASH;
const PASS_COOKIE        = 'wpse_pass_'      . COOKIEHASH;
const AUTH_COOKIE        = 'wpse_'           . COOKIEHASH;
const SECURE_AUTH_COOKIE = 'wpse_sec_'       . COOKIEHASH;
const LOGGED_IN_COOKIE   = 'wpse_logged_in_' . COOKIEHASH;
const TEST_COOKIE        = 'wpse_test_cookie';

where we must adjust the site url http://example.tld to our needs.

But I also wonder, as @PieterGoosen, why you need to change it.

  • Why change it. To hide traces of wordpress for security reasons. – wp student Aug 14 '16 at 4:05
  • I was hoping that the OP would explain better his needs and reasons. I looked into this out of "theoretical" curiosity ;-) In general I don't think this makes any difference on HTTP connections and one should aim for HTTPS encryption to avoid e.g. network sniffing. But I'm not a security expert ;-) @wpstudent – birgire Aug 14 '16 at 10:57
  • 1
    Another reason to change it... two installations can potentially have a conflict in the login (cannot be logged into both at once in the same browser instance). This solves that! – groovenectar Sep 1 '16 at 7:40
  • thanks for commenting and mentioning an usage case @groovenectar – birgire Sep 1 '16 at 9:02
1

To add to the comments... another reason for changing the test cookie in particular is to block bad logins. Ripped straight outta the always excellent ask apache...

http://www.askapache.com/security/stop-wordpress-exploits-spam/#Block_Logins_bad_cookie

Block Logins with bad cookie

You should all be using a custom login cookie name definable with constants in your wp-config.php file. That means the default cookie wordpress_test_cookie will never be set, so you can block bots that use this default!

The way to deviate from the default is to set this constant to anything you want in your wp-config.php

define( 'TEST_COOKIE', 'use_this_cookie_name_instead_of_wordpress_test_cookie' );

Block bad test cookies

RewriteCond %{THE_REQUEST} ^POST.*wp-login [NC]
RewriteCond %{HTTP:Cookie} "wordpress_test_cookie=WP+Cookie+check" [NC]
RewriteRule .* - [F]'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.