{"id":10332,"date":"2026-09-02T07:25:00","date_gmt":"2026-09-02T05:25:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10332"},"modified":"2026-08-19T10:53:54","modified_gmt":"2026-08-19T08:53:54","slug":"two-years-requested-seven-days-granted","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/","title":{"rendered":"Two Years Requested, Seven Days Granted"},"content":{"rendered":"

A cookie header is a request, not an instruction. Max-Age=63072000<\/code> asks for two years, and what the browser grants depends on something the header does not mention: how the cookie came into being. The same line produces two years in one case and seven days in another, and nothing in the response says which.<\/p>\n

The difference matters beyond tidiness. A returning visitor is only returning as long as the cookie that recognises them exists; once it is gone they are counted as new, and every window longer than the cookie’s life is arithmetic on data that no longer exists.<\/p>\n

\n\"A
The same header, three outcomes. Which one applies is decided before the header is written.<\/figcaption><\/figure>\n

The Three Caps<\/h2>\n

Safari caps every cookie written through document.cookie<\/code> at seven days. That is the rule with the largest practical effect, because most measurement cookies are written exactly that way – by a tag that runs in the page.<\/p>\n

Safari applies the same seven days to cookies that arrive in an HTTP response from a host that resolves elsewhere through a CNAME. The intention is to catch the arrangement where a subdomain of the site points at a measurement provider; the effect is that a first-party cookie set the correct way is treated like a third-party one.<\/p>\n

Chrome and Firefox cap at 400 days. That number rarely hurts – it is above every reasonable measurement window – but it does quietly end the two-year cookie that has been in the tag template since 2018.<\/p>\n

Why the Route Decides, Not the Attribute<\/h2>\n

Two cookies with identical attributes can have different lifetimes, and the only difference is who wrote them. A cookie set by a script in the page is capped; the same cookie set in the response of one’s own server is not.<\/p>\n

That is why moving the cookie into the response is the single most effective change available: it costs one endpoint on one’s own domain, and it is the difference between recognising a visitor for a week and recognising them for a year. The tag then reads the cookie rather than writing it.<\/p>\n

The move has a second effect that is worth stating: a cookie written in a response can carry HttpOnly<\/code>, and a cookie with HttpOnly<\/code> cannot be read by any script on the page – including the ones nobody put there deliberately.<\/p>\n

What a CNAME Changes<\/h2>\n

A subdomain pointing at a provider looks first-party in the address bar and is transparent to the browser: the resolution chain is visible, and the browser can see that the host ends up somewhere else. That is what the cloaking defence keys on.<\/p>\n

The consequence is worth planning for rather than discovering: an arrangement built to escape third-party restrictions inherits the seven-day cap in Safari and gains, in return, a subdomain whose failure takes the whole measurement with it. Where the endpoint runs on one’s own infrastructure, neither applies.<\/p>\n

The Attributes a Cookie Fails On<\/h2>\n\n\n\n\n\n\n\n\n\n
Written like this<\/th>\nWhat happens<\/th>\n<\/tr>\n<\/thead>\n
SameSite=None<\/code> without Secure<\/code><\/td>\nRejected outright by every current browser – the cookie is never stored.<\/td>\n<\/tr>\n
No SameSite<\/code> at all<\/td>\nTreated as Lax<\/code>, so the cookie is absent from cross-site requests.<\/td>\n<\/tr>\n
__Host-<\/code> with a Domain<\/code><\/td>\nRejected: the prefix forbids Domain and requires Secure and Path=\/.<\/td>\n<\/tr>\n
Name and value above 4096 bytes<\/td>\nDropped without a word, which is how a consent string that grew stops arriving.<\/td>\n<\/tr>\n
Max-Age<\/code> and Expires<\/code> together<\/td>\nMax-Age wins. Expires is only there for browsers nobody has anymore.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

All of these fail the same way: the response is fine, the cookie is simply not there afterwards. The only reliable check is to look at what the browser stored rather than at what was sent.<\/p>\n

What Follows for the Measurement<\/h2>\n

A seven-day cookie makes a visitor who returns after eight days a new one. In a report that shows up as a share of returning visitors that is lower on Safari than everywhere else, and as conversion paths that are shorter than the sales cycle – not because the journey was short, but because the earlier part is no longer connected to it.<\/p>\n

Where the cookie cannot be extended, the honest response is to shorten the window rather than to keep reporting one the data cannot support. A thirty-day attribution window over a seven-day cookie describes a period the browser has no memory of, and every figure derived from it inherits that gap.<\/p>\n","protected":false},"excerpt":{"rendered":"

How long a cookie survives is decided by the way it was set, not by the header. The three caps that apply, why a CNAME changes the answer, and what a seven-day cookie does to a report.<\/p>\n","protected":false},"author":1,"featured_media":11431,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[91261,91115],"class_list":["post-10332","post","type-post","status-publish","format-standard","hentry","category-digital-marketing","tag-conversion-tracking","tag-web-security"],"yoast_head":"\nTwo Years Requested, Seven Days Granted - Lukas Wojcik - Blog<\/title>\n<meta name=\"description\" content=\"Safari caps JavaScript cookies at seven days, Chrome and Firefox everything at 400. Which route survives and what a CNAME changes.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Two Years Requested, Seven Days Granted - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Safari caps JavaScript cookies at seven days, Chrome and Firefox everything at 400. Which route survives and what a CNAME changes.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-02T05:25:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-10332-two-years-requested-seven-days-grant-c.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"luky\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"luky\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/\"},\"author\":{\"name\":\"luky\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"Two Years Requested, Seven Days Granted\",\"datePublished\":\"2026-09-02T05:25:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/\"},\"wordCount\":722,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-10332-two-years-requested-seven-days-grant-c.png\",\"keywords\":[\"Conversion Tracking\",\"Web Security\"],\"articleSection\":[\"Digital Marketing\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/\",\"name\":\"Two Years Requested, Seven Days Granted - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-10332-two-years-requested-seven-days-grant-c.png\",\"datePublished\":\"2026-09-02T05:25:00+00:00\",\"description\":\"Safari caps JavaScript cookies at seven days, Chrome and Firefox everything at 400. Which route survives and what a CNAME changes.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-10332-two-years-requested-seven-days-grant-c.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hero-10332-two-years-requested-seven-days-grant-c.png\",\"width\":1200,\"height\":630,\"caption\":\"Two Years Requested, Seven Days Granted\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-marketing\\\/two-years-requested-seven-days-granted\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Two Years Requested, Seven Days Granted\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"],\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/author\\\/luky\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Two Years Requested, Seven Days Granted - Lukas Wojcik - Blog","description":"Safari caps JavaScript cookies at seven days, Chrome and Firefox everything at 400. Which route survives and what a CNAME changes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/","og_locale":"en_US","og_type":"article","og_title":"Two Years Requested, Seven Days Granted - Lukas Wojcik - Blog","og_description":"Safari caps JavaScript cookies at seven days, Chrome and Firefox everything at 400. Which route survives and what a CNAME changes.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-09-02T05:25:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-10332-two-years-requested-seven-days-grant-c.png","type":"image\/png"}],"author":"luky","twitter_card":"summary_large_image","twitter_misc":{"Written by":"luky","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/"},"author":{"name":"luky","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"Two Years Requested, Seven Days Granted","datePublished":"2026-09-02T05:25:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/"},"wordCount":722,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-10332-two-years-requested-seven-days-grant-c.png","keywords":["Conversion Tracking","Web Security"],"articleSection":["Digital Marketing"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/","name":"Two Years Requested, Seven Days Granted - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-10332-two-years-requested-seven-days-grant-c.png","datePublished":"2026-09-02T05:25:00+00:00","description":"Safari caps JavaScript cookies at seven days, Chrome and Firefox everything at 400. Which route survives and what a CNAME changes.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-10332-two-years-requested-seven-days-grant-c.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/hero-10332-two-years-requested-seven-days-grant-c.png","width":1200,"height":630,"caption":"Two Years Requested, Seven Days Granted"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-marketing\/two-years-requested-seven-days-granted\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Two Years Requested, Seven Days Granted"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"],"url":"https:\/\/www.lukaswojcik.com\/blog\/author\/luky\/"}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/10332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=10332"}],"version-history":[{"count":2,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/10332\/revisions"}],"predecessor-version":[{"id":12033,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/10332\/revisions\/12033"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/11431"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=10332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=10332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=10332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}