Document reference: f3fdec64fb3e
Essential account cookies
WordPress uses cookies for website login and account-session functions. The “keep me signed in” option can extend your login session according to WordPress settings. Logout and password reset operate through WordPress account functions.
Form-protection cookie
The Core plugin sets a signed vfc_form cookie for visitors using login, registration, reset, contact, complaints or setup forms. It is used to bind form verification to the browser. Its stated lifetime is up to 12 hours. It is marked HttpOnly and SameSite=Lax, and Secure when the site is served over HTTPS.
What this release does not add
This Core release does not add advertising cookies, third-party analytics scripts, broker tracking pixels or a Telegram embed. Opening an external link may allow that separate service to set its own cookies.
Your controls
You can remove or block cookies in your browser. Disabling essential cookies may prevent login or form submission. Cache, security and analytics tools added by the site operator can introduce additional technologies and require their own disclosure or controls.
Keeping the notice accurate
The site operator should audit the actual installed tools and obtain any permissions required for non-essential technologies. This Core release does not provide consent management for tracking added by other software.