FAIR

Federated and Independent Repositories

Show Me The Cookies

Plugin Banner

Show Me The Cookies

by Jay Versluis

Download
Description

Show Me The Cookies displays all current cookies your site is using. Once activated, you can find this list under Appearance – Cookies.

You can also display this list to your visitors by placing the shortcode [cookies] into any post or page.

WordPress uses several cookies under the hood by default. If you’d like to filter these out, use the shortcode [cookies-nowp], which will show a message if no non-WordPress cookies are found.

This plugin is based on code by David Artiss, who kindly made it available on GitHub.

To find out more about what cookies are and what can be done with them, please read https://en.wikipedia.org/wiki/HTTP_cookie

  1. Either: Upload the entire folder cookies to the /wp-content/plugins/ directory.
  2. Or: Download the ZIP file, then head over to Plugins – Add New – Upload Plugin, then browse to your file.
  3. Or: From Plugins – Add New, search for “show me the cookies” and hit Install.
  4. Then: Activate the plugin through the Plugins menu in WordPress.
  5. You can view your cookies under Appearance – Cookies.
  1. List of cookies in the Admin Interface

    List of cookies in the Admin Interface

  2. Example of shortcode displayed in TwentyThirteen theme

    Example of shortcode displayed in TwentyThirteen theme

None so far.

Very nice!

By apventura on January 15, 2023

Thank you very much for this clean and very useful plugin! It helps me a lot. It proves that simplicity is king!

I suggest a little improvement to author: when there is no cookies to show, the plugin should return a string like "no cookies to show".

Good work!

Great idea – but important information is missing

By Martin Sauter (martin.sauter) on July 26, 2021

If you need to know which cookies are created by your WP website (because you need to set up a GDPR-compliant cookie banner, for example), then this plugin comes in handy. However, in the current version it does not display the information which component/script creates a specific cookies, which would be crucial in certain situations.

Simple and effective

By Gerrardfisher on July 17, 2020

Simple to install, clear list of functional cookies on my site (which is hard to track using the inspect function on browsers because some come and go as pages load up) This plugin really helped me to nail down my cookie control and opt-in settings on my site. Thank you!

perfect for the cookie crumbs

By TLCJohn on April 2, 2019

Hi there Jay, Thank you for this great little plugin. It is great for showing the list of cookies that are om a WordPress site. This really make our lives much easier. The plugin is really sweet. Cheers, John

1.2

  • Security: added sensitive cookie denylist — hides WordPress auth, session, and token cookies from shortcode output
  • Security: cookie values are now masked in all output (first 3 + ••• + last 3 characters)
  • Security: shortcodes now hide values by default; opt in with show_values=”true” to display masked values
  • Security: added admin notice warning that cookie values may contain sensitive session data
  • Removed: is_wp_cookie() replaced by the more robust is_sensitive_cookie() denylist method
  • Changed: [cookies] and [cookies-nowp] shortcode attribute novalue replaced by show_values=”true”
  • Improved: admin cookie list shows all cookies (including WordPress ones) with masked values
  • Added: cookie value size (character count) displayed beneath each value in the admin list
  • Fixed: [cookies] shortcode now shows an informative message when no non-sensitive cookies are found

1.1

  • Security: escaped all cookie name and value output to prevent XSS
  • Security: removed do_shortcode() wrapping on cookie data to prevent shortcode injection
  • Security: added direct file access guard
  • Security: removed third-party social media scripts from admin page
  • Fixed: undefined variables in admin cookie list function (PHP 8 compatibility)
  • Fixed: capability check mismatch between menu registration and access guard
  • Added: Text Domain declaration for translations
  • Updated: requires PHP 8.0 and WordPress 5.9 or later
  • Code: refactored into a class to avoid global namespace pollution
  • Improved: shortcode and admin cookie list now share a consistent format (Cookie #N / Value)
  • Improved: [cookies-nowp] shows a message when no non-WordPress cookies are found
  • Removed: custom separator feature (enclosing shortcode form [cookies]…[/cookies])

1.0

  • Initial Release
  • Based on code by David Artiss (thanks, David!)
Back to top