I don't want my WP site to set any persistent cookies. Session cookies while I'm logged in are all I want to allow. I don't want to have to ask visitors for consent, so I need to be sure that none are set. Unfortunately WP makes this difficult.
I see that the
wp_generate_auth_cookie function requires an expiry timestamp, so it's not capable of setting a session-only cookie. Amongst the cookies that are set by WP, one is curious.
wordpress_test_cookie is the only one set without an expiry – so WP is clearly capable of doing this. It's curious that this particular cookie is set as session-only, which may mean that its utility as a cookie setting check is limited.
How can I persuade WP to not set cookies like that? It's also common for plugins to set cookies without consent or warning, and I want to be able to block them from doing so too.
I'm also looking at an alternative way to deal with this: use Lua scripting in my nginx reverse proxy to modify or delete cookies as they pass by, stripping expiry values from them, and possibly ensuring that all
sameSite flags are set.
Yes, I am fully aware that this may compromise some aspects of using WordPress, and some plugins will break, but visitor privacy and the law takes precedence.
Are there plugins or other solutions that can help with this?