为何WordPress会为非管理员用户设置/wp-admin及插件路径的Cookie？

1. Why does WordPress set cookies for non-admins on /wp-admin and /wp-content/plugins paths? #

• First off, don’t write off non-admins as never needing access to /wp-admin! Roles like Editors, Authors, even Contributors need to log into the admin area to create or edit content—they just don’t have full admin permissions. WordPress uses path-restricted cookies here as a security best practice: it limits the scope of each cookie to only the areas the user actually needs access to, so if a cookie is ever compromised, the damage is contained.
• For /wp-content/plugins, plenty of plugins aren’t just admin-only tools. Many add front-end features like logged-in user pre-filled contact forms, member-only content, or submission tools that need to verify a user’s identity. The path restriction ensures this cookie only works for plugin-related requests, cutting down on unnecessary exposure of session data.

2. Why do non-admins need the two wordpress_sec_... cookies (for /wp-admin and /wp-content/plugins)? #

• The wordpress_sec_ cookies are security-focused session validation cookies—they work hand-in-hand with wordpress_logged_in_ to block session hijacking attempts. WordPress splits these into path-specific versions for two key reasons:
  • Isolation of sensitive areas: Even if a non-admin only has limited access to /wp-admin (like editing their own posts), separating the security cookie for this path means a compromise in a plugin’s front-end functionality (which uses the /wp-content/plugins cookie) won’t give an attacker a foothold in the admin area.
  • Plugin-specific authentication: Lots of plugins handle their own permission checks that don’t rely on the main admin cookie. For example, a forum plugin might let subscribers edit their own threads or post comments—having a dedicated security cookie for the plugin path ensures these requests are validated without exposing the main admin session cookie unnecessarily.

Quick side note: All these cookies are part of WordPress’s core session management, built to balance usability (letting non-admins access the features they need) with tight security (limiting cookie scope to reduce risk).

内容的提问来源于stack exchange，提问作者rokpoto.com