Cookie policy
A plain-English rundown of the cookies we use and how to switch them off.
Last updated October 20, 2026
Cookies are small files a site stores in your browser. We use them sparingly. The table below lists every cookie this site can set. The only analytics cookies are the Google Analytics ones, set only if you allow them, and we run no advertising cookies. Cookies that are not strictly necessary are set only with your consent, which you can change or withdraw at any time, category by category.
Our security plugin (Wordfence) can also set a small number of strictly necessary security cookies. These protect the site rather than track you, almost exclusively concern accounts that log in to the site, and are never used for advertising or analytics.
Besides Google Analytics, we measure traffic with Ahrefs Web Analytics, which is cookieless. It stores nothing in your browser, so it has no row in the table below and nothing to switch off there. It counts visits without identifying you, and never follows you to another site. Our privacy policy explains exactly what each tool records.
| Cookie | Provider | Category | Purpose | Duration | Consent needed |
|---|---|---|---|---|---|
| cmp_consent | Abode & Grove | Necessary | Remembers your consent choice for each cookie category, so the banner does not ask again on every page. | 1 year | No (necessary) |
| wp-settings-(id), wp-settings-time-(id) | WordPress | Necessary | Remembers layout preferences inside the WordPress admin screens. Set only for accounts that sign in to run the site, never for ordinary visitors. | 1 year | No (necessary) |
| wordpress_logged_in_(hash), wordpress_sec_(hash), wordpress_test_cookie | WordPress | Necessary | Keeps a site account signed in to the WordPress admin, and checks that the browser accepts cookies at login. Set only for accounts that sign in to run the site, never for ordinary visitors. | Session, or 14 days if “Remember me” is ticked | No (necessary) |
| wfwaf-authcookie-(hash) | Wordfence (Defiant, Inc.) | Security | Lets the Wordfence firewall check a signed-in user’s access level before WordPress loads, so administrators are not blocked by firewall rules. Set only when you log in to the site. | 12 hours | No (necessary) |
| wf_loginalerted_(hash) | Wordfence (Defiant, Inc.) | Security | Records that the administrator has already been alerted about a sign-in from this device. Only used if login alerts are enabled, and set only when you log in to the site. | Persistent | No (necessary) |
| wfCBLBypass | Wordfence (Defiant, Inc.) | Security | Allows a visitor who knows a hidden bypass address to pass country blocking. It is only used if country blocking is enabled, and we do not currently use it. | Only if enabled | No (necessary) |
| wfls-remembered-(hash) | Wordfence (Defiant, Inc.) | Security | Remembers a trusted browser for two-factor login when a signed-in user chooses “remember this device”. Set only for site accounts that use two-factor authentication. | Up to 30 days | No (necessary) |
| _ga | Google (Google Analytics) | Analytics | Gives your browser a random ID so Google Analytics can tell new visitors from returning ones. It holds no name, email address or account. Set only after you allow analytics cookies. | 13 months | Yes (analytics) |
| _ga_MW4G9ZP17G | Google (Google Analytics) | Analytics | Keeps track of the current visit for this site’s Google Analytics property, such as when it started and how many pages it covered. Set only after you allow analytics cookies. | 13 months | Yes (analytics) |
| embed-privacy | Abode & Grove | Functional | Remembers the providers whose embedded content you chose to always display (for example YouTube), so their videos and posts load without a click. Set only when you tick “Always display content from …”, a box that appears only once functional cookies are allowed. | 1 year | Yes (functional), when you tick the box |
| Embedded video and social-media cookies | YouTube, Vimeo, TikTok, Instagram, Spotify, X, Reddit | Third party | Articles can embed a video or post. Nothing loads from the provider until you click its placeholder; when you do, the provider may set or read its own cookies under its own policy. YouTube videos load in YouTube’s privacy-enhanced mode (youtube-nocookie.com). | Set by the provider | On their content, after your click |
Nothing on this site fingerprints your device or follows you to another one.
Embedded videos and posts work the same way: nothing loads from YouTube, Vimeo, TikTok, Instagram or the other providers until you click the placeholder, and any cookies the provider then sets belong to its own domain and its own policy. The “Always display content from …” box only appears once you allow functional cookies.
Managing and withdrawing consent
When you first visit, a consent banner lets you accept all cookies, reject everything that is not essential, or choose category by category. You can review or change your choice at any time using the button below.
Withdrawing functional consent also deletes the functional cookie this site set in your browser (embed-privacy), and the “Always display content from …” box disappears until you allow it again.
Withdrawing analytics consent stops Google Analytics on this site straight away and deletes the Google Analytics cookies (_ga and _ga_…) this site set in your browser. Google also offers a browser add-on that blocks Google Analytics on every site: tools.google.com/dlpage/gaoptout.
You can also block or delete cookies in your browser settings at any time, and most browsers offer private-browsing modes. Blocking essential cookies may stop parts of the site from working. For how cookie data relates to your wider rights, see our privacy policy.
We keep this policy up to date as the site evolves. It reflects our actual practices but is not a substitute for tailored legal advice.