A cache test with one cookie can pass while a second cookie is ignored. If public content depends on two independent visitor choices, change each choice separately and verify the response. Do not assume that a generated filename or one correct visit proves all declared variants are isolated.
Why the 3.24 change matters
WP Rocket's 3.24 release includes a fix that preserves every dynamic-cookie declaration. The upstream explanation describes part-based declarations being lost during deduplication and additional handling for missing or differently shaped values. It also includes a configuration-regeneration step for the update.
This is a focused compatibility issue. It does not mean every website using cookies has leaked personal information. If you actually observe private content in another session, stop using shared caching for that response and escalate the incident. A public-content variant test must never become an experiment with customer records.
List what each cookie is supposed to do
For each relevant cookie, record its owner, allowed values and effect on the public response. Separate cookies that select a variant from cookies that merely prevent caching until a prerequisite exists. WP Rocket's dynamic and mandatory cookie documentation describes those distinct roles.
Do not register every cookie you see as a dynamic cache key. Session identifiers, analytics IDs and rapidly changing values can create excessive variants or inappropriate caching behavior. The goal is a small, understood set of public outputs. Login, account and personalized responses need their own safe cache policy.
Create a four-state test
On staging, use two harmless settings whose visible results you can identify. For example, a demonstration banner could have a region choice and a display-density choice. These names are synthetic fixtures, not built-in WP Rocket options. Set them through the test integration rather than editing unrelated production cookies.
| State |
Region |
Density |
Expected public marker |
| A |
North |
Compact |
North / Compact |
| B |
North |
Expanded |
North / Expanded |
| C |
South |
Compact |
South / Compact |
| D |
South |
Expanded |
South / Expanded |
Visit A, B, C and D in isolated sessions, then repeat in reverse order. The reverse pass catches cases where the first request populated a shared response. Record the final URL and visible marker alongside the request's synthetic cookie values.
Changing either synthetic cookie dimension must select the intended public content, including when the other dimension stays fixed. Explanatory example, not a customer test.
Inspect declarations and generated configuration
Have the integration maintainer compare its registered declarations with WP Rocket's generated configuration after the supported update. Look for a declaration disappearing, not just a different filename. Do not manually edit generated files as a permanent repair; the next settings save may replace them.
Test the integration's documented behavior when an optional value is missing. A missing value should not produce a PHP failure or unexpectedly expose another variant. If a cookie is declared by parts, keep the test within the integration's expected structure and have its maintainer review unexpected input handling. Do not send uncontrolled probes to a third-party site.
Check upstream caches separately
A CDN or host cache may answer before WP Rocket processes cookies. Compare the same states at the public layer and through a host-approved origin diagnostic. If the origin is correct and the public response is not, give the cache owner the exact failing state pair. Do not solve the discrepancy by making all authenticated content publicly cacheable.
Also measure the cost of the change. More valid variants mean more possible cache entries. Track the number of expected states, disk growth and warm-up work under representative traffic. If rebuild load becomes the next problem, use the cache lifespan and purge-cycle guide instead of repeatedly clearing everything.
Acceptance criteria
Every approved state returns the intended public content after either warm-up order, missing optional values are handled deliberately, and private responses remain excluded. Preserve the fixture matrix and versions. HandL WP performance troubleshooting can help align plugin and CDN behavior when the two layers disagree.
Sources reviewed October 31, 2026. The suggested checks and diagrams are diagnostic aids, not claims of tests performed on your site.