# WordPress Comment Cookies: The Consent Gap Almost Every Blog Misses | ConsentPaladin

Source: https://consentpaladin.com/blog/2026-10-05-wordpress-comment-cookies-consent-gap.html

[Home](../index.md) / [Blog](index.md) / WordPress analytics plugins: the ones that fire before consent


## The cookies your banner never sees

WordPress has a consent problem hiding in plain sight: the comment form. When a visitor leaves a comment, WordPress sets cookies to remember their name, email, and URL for next time. These are not strictly necessary cookies. They are convenience cookies, and under most consent frameworks they require consent before being set. But they fire from WordPress core, outside the plugin ecosystem your banner controls, so they slip past nearly every consent implementation.

This is the kind of gap auditors love. The site has a polished banner, a preference center, documented consent records, and then a core WordPress behavior quietly setting cookies for every commenter regardless of their choice. The banner says one thing. The site does another. And because comment cookies are invisible in normal testing, the gap survives for years.

## Why it happens

Consent plugins manage scripts and embeds. They hook into the page lifecycle, block tags until consent, and release them when the user agrees. Comment cookies do not work that way. They are set server-side by WordPress core when the comment form is submitted, in response to a checkbox on the form itself. The consent plugin never sees the transaction. It is a different mechanism, in a different layer, managed by nobody.

The form checkbox makes it worse, because it looks like consent. The comment form includes a save-my-details checkbox, and site owners assume that covers it. It does not, or at least not reliably. The checkbox is per-comment and poorly integrated with the site's consent records. It does not respect the banner's global choice, it is not logged in the consent database, and its wording rarely meets the standard for informed consent. It is a UX convenience wearing a compliance costume.

## How to close the gap

The cleanest fix is to disable comment cookies entirely. Most blogs do not need WordPress to remember commenter details, and the convenience is minor compared to the compliance exposure. A single filter in the theme or a small plugin removes the behavior completely, and the comment form keeps working. If nobody misses it, and nobody will, this is the whole fix.

If you want to keep the convenience, gate it behind real consent. Tie the comment form's remember-me behavior to the banner's consent state: only set the cookies when the user has accepted the relevant category. This requires a small amount of custom code, because no major consent plugin handles it out of the box. The logic is simple: check the consent state on comment submission, set the cookies only on acceptance, and log the choice with the rest of the consent records.

Then audit for the siblings. Comment cookies are the famous case, but WordPress core and common plugins have other server-side behaviors that bypass script-based consent: login cookies with extended durations, certain caching behaviors, and plugin features that set cookies on form submission rather than page load. The lesson of the comment cookie is structural. Consent is not just about scripts. It is about every cookie the site sets, through every mechanism, and the only way to be sure is to test the real behavior, not the banner's claims.

## Frequently asked questions

### Why are WordPress comment cookies a consent gap?

WordPress sets cookies to remember a commenter's name, email, and site for next time. Many site owners never notice them, so they appear in no cookie list and no banner category, even though they store visitor information.

### How can commenters control these cookies?

The comment form includes an opt in checkbox for saving details, which should stay unticked by default. Site owners can also disable the cookies entirely if the convenience is not worth the compliance surface.

### Should comment cookies be listed in the cookie policy?

Yes. Every cookie the site sets belongs in the inventory with its purpose and lifetime, including the unglamorous functional ones. Inventories built only from marketing tags are the ones that fail audits.

## Get a free consent audit of your website

[Free consent audit](mailto:hello@consentpaladin.com?subject=Free%20consent%20audit%20-%20consentpaladin.com)