Website? Request now!
← Back to the glossary

Web design · Development · SEO

Cookie

Cookies explained: small pieces of browser state

Editorially reviewed ·

Clear definition

An HTTP cookie is a small value that a server asks a browser to store and that may be returned with matching later requests. Cookies support session identifiers, language preferences, shopping baskets, or measurement functions. They do not necessarily store personal data in plain text, but even a pseudonymous identifier may relate to a person or device.

Scope and behaviour are controlled through attributes such as Domain, Path, Expires or Max-Age, Secure, HttpOnly, and SameSite. Cookies have size and quantity limits and are not general-purpose storage. Confidential data should not be stored directly in them. Technical necessity, consent, and retention must be assessed according to purpose and applicable law.

Cookie in practice

Cookies are sent according to domain and path and should remain as small and limited as possible. Attributes such as Secure, HttpOnly, and SameSite reduce common risks but need to match the specific purpose.

Web communication consists of individual requests and responses governed by headers, status codes, and security rules. Cookies are only one possible storage and transfer mechanism within that system. Purpose, lifetime, access protection, transmission, and consent need separate evaluation. A technically available mechanism is not automatically necessary or legally permitted.

Cookie: relevance to SEO, paid search, and GEO

Protocol and cookie configuration can affect redirects, caching, security, and tracking. Mistakes lead to duplicate URLs, lost sessions, or incomplete conversions. SEO crawls, browser tests, and campaign measurement should therefore cover different consent and authentication states. Privacy notices do not replace a technical review of the requests that are actually sent.

For search and answer systems, coverage of Cookie should distinguish its definition, scope, and evaluation criteria. The editorial reference is “RFC 6265: HTTP State Management Mechanism” by IETF, making central claims traceable for readers and machine-based systems.

Practical code example

PHP

Security attributes for a session cookie

Secure restricts transmission to HTTPS, HttpOnly prevents JavaScript access, and SameSite limits cross-context transmission.

<?php
setcookie('session_id', $sessionId, [
    'expires' => 0,
    'path' => '/',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

Sources and further reading

  1. Standard RFC 6265: HTTP State Management Mechanism IETF · Checked

Frequently asked questions

A cookie is a small browser value that a website can set and receive again with matching later HTTP requests.

There is no universal answer. Purpose, technical necessity, and applicable law determine the requirement; non-essential analytics and advertising often require prior consent.