Im trying to figure out how can I change names to cookies that wordpress is setting for example on login.

wordpress_test_cookie = sitename_test_cookie

or/ and

 wordpress_logged_in = sitename_test_cookie
  • 1
    Any specific reason for this? Sep 8, 2015 at 10:27
  • in my case, I have to install another wordpress instance in the subdirectory. i don't want to create a conflict in the login instances
    – Earlee
    Jan 26, 2021 at 13:24

2 Answers 2


Check out the wp_cookie_constants() and ms_cookie_constants() functions, to see available cookies.

We can try this in the wp-config.php file:

// Here we just simulate how it's done in the core
define( 'COOKIEHASH',           md5( 'http://example.tld' )    ); 

// Then we override the cookie names:
define( 'USER_COOKIE',          'wpse_user_'      . COOKIEHASH );
define( 'PASS_COOKIE',          'wpse_pass_'      . COOKIEHASH );
define( 'AUTH_COOKIE',          'wpse_'           . COOKIEHASH );
define( 'SECURE_AUTH_COOKIE',   'wpse_sec_'       . COOKIEHASH );
define( 'LOGGED_IN_COOKIE',     'wpse_logged_in_' . COOKIEHASH );
define( 'TEST_COOKIE',          'wpse_test_cookie'             );

or using PHP 5.6+ :

// Then we override the cookie names:
const USER_COOKIE        = 'wpse_user_'      . COOKIEHASH;
const PASS_COOKIE        = 'wpse_pass_'      . COOKIEHASH;
const AUTH_COOKIE        = 'wpse_'           . COOKIEHASH;
const SECURE_AUTH_COOKIE = 'wpse_sec_'       . COOKIEHASH;
const LOGGED_IN_COOKIE   = 'wpse_logged_in_' . COOKIEHASH;
const TEST_COOKIE        = 'wpse_test_cookie';

where we must adjust the site url http://example.tld to our needs.

But I also wonder, as @PieterGoosen, why you need to change it.

  • Why change it. To hide traces of wordpress for security reasons.
    – wp student
    Aug 14, 2016 at 4:05
  • I was hoping that the OP would explain better his needs and reasons. I looked into this out of "theoretical" curiosity ;-) In general I don't think this makes any difference on HTTP connections and one should aim for HTTPS encryption to avoid e.g. network sniffing. But I'm not a security expert ;-) @wpstudent
    – birgire
    Aug 14, 2016 at 10:57
  • 3
    Another reason to change it... two installations can potentially have a conflict in the login (cannot be logged into both at once in the same browser instance). This solves that! Sep 1, 2016 at 7:40
  • thanks for commenting and mentioning an usage case @groovenectar
    – birgire
    Sep 1, 2016 at 9:02

To add to the comments... another reason for changing the test cookie in particular is to block bad logins. Ripped straight outta the always excellent ask apache...


Block Logins with bad cookie

You should all be using a custom login cookie name definable with constants in your wp-config.php file. That means the default cookie wordpress_test_cookie will never be set, so you can block bots that use this default!

The way to deviate from the default is to set this constant to anything you want in your wp-config.php

define( 'TEST_COOKIE', 'use_this_cookie_name_instead_of_wordpress_test_cookie' );

Block bad test cookies

RewriteCond %{THE_REQUEST} ^POST.*wp-login [NC]
RewriteCond %{HTTP:Cookie} "wordpress_test_cookie=WP+Cookie+check" [NC]
RewriteRule .* - [F]'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.