It’s standard practice to avoid caching sensitive or private customer data on servers to protect visitor privacy. This ensures that personalized web pages are never stored in the public cache.

RunCache achieves this by immediately bypassing the cache when a visitor’s web browser sends a cookie matching an exclusion rule.

This guide explains how RunCache handles default cookies, why online shoppers see bypassed pages, and how to safely add your own custom cookie exclusions.

RunCache organizes cookie exclusions into two groups: permanent rules and configurable dashboard rules.

The Five Permanent Rules

RunCache includes five cookie rules that cannot be disabled. These patterns protect standard WordPress sessions and administrative functions:

  • wordpress_logged_in
  • wordpress_sec_
  • wp-postpass
  • comment_author
  • wp-settings-

RunCache performs a substring test against incoming cookie names. For example, the pattern wordpress_logged_in matches the unique session cookie wordpress_logged_in_9a3f1c2b, and wp-settings- matches wp-settings-1.

Because these rules are always active, any logged-in user bypasses the page cache on every request. This is why you can’t test whether page caching works while you are signed into your WordPress dashboard.

You can read more about what these cookies store in the WordPress cookie reference.

The Nine Default Dashboard Rules

When you install RunCache, the “Exclude Cookie” setting includes nine preconfigured rules:

  • wordpress_sec_[a-f0-9]+
  • woocommerce_cart_hash
  • woocommerce_items_in_cart
  • wp_woocommerce_session
  • wc_cart_hash
  • edd_items_in_cart
  • wp-customize
  • customize_changeset_uuid
  • woocommerce_recently_viewed

Seven of these rules manage e-commerce session states. When a shopper adds an item to their cart in WooCommerce, the browser receives the woocommerce_items_in_cart cookie. Because this cookie is present on subsequent requests, every page the shopper visits bypasses the cache, not just the checkout or cart page.

Easy Digital Downloads shoppers experience the same behavior through the edd_items_in_cart cookie. Seeing an X-RunCache-Status: BYPASS header on a product page while an item is in the shopper’s cart indicates that the rule is protecting user data as intended.

The “Cookie Rules” card also contains a toggle labeled “Exclude DONOTCACHEPAGE constant”. This is a separate WordPress performance setting that automatically bypasses caching whenever plugins trigger dynamic page constants. You can learn more about this feature in our guide on DONOTCACHEPAGE for developers.

If you use a custom membership plugin, a forum system, or an application that sets unique visitor cookies, you can add those cookies to your exclusion list.

  1. Open your website in a web browser.
  2. Open your browser developer tools (press F12 or right-click and select “Inspect”).
  3. Navigate to the Application panel in Chrome or the Storage panel in Firefox.
  4. Expand the “Cookies” section and select your domain name.
  5. Identify and copy the exact name fragment of the cookie you want to exclude.
  1. Log in to your WordPress dashboard as an administrator.
  2. Navigate to RunCache > Rules.
  3. Locate the “Cookie Rules” section.
  4. Verify that the “Exclude Cookie” toggle switch is turned on.
Exclude cookies
  1. Enter your cookie name on a new line in the text area.
  2. Scroll to the bottom of the page and click Save Changes.

Your changes take effect immediately on the next request. You do not need to purge your existing cache.

  • One pattern per line: Enter each cookie rule on its own line.
  • Names, not values: RunCache evaluates cookie names, not their values. You cannot bypass caching based on a specific cookie value.
  • Avoid broad patterns: Cookie rules use substring matching. If you add a short or generic pattern like _ga, it will match all Google Analytics cookies. Because nearly every visitor carries analytics cookies, a broad pattern will silently disable page caching for your entire site.

To ensure that your cookie rule functions properly without unintentionally disabling your cache, test both the presence and absence of the cookie.

Run a curl command in your terminal that sends your custom cookie header using a GET request:

curl -s -o /dev/null -D - -H "Cookie: my_custom_cookie=1" https://example.com/ | grep -i x-runcache

A properly configured rule will return a bypass status:

Cache status

Next, make a standard request to the same URL without providing any cookie headers:

curl -s -o /dev/null -D - https://example.com/ | grep -i x-runcache

Once the page has been visited once and warmed up, the output should show HIT instead of the BYPASS header.

Cache hit in RunCache

If both commands return BYPASS, your cookie pattern is too broad and matches cookies that ordinary visitors carry. If neither command returns any X-RunCache headers, review our guide on what to do when nothing is being cached.