0

My website host logs information about users visiting my website such as number of visitors, ip addresses, their browser info, geographical info and all that standard stuff. How is this info collected? Throgh cookies? I ask because i am writing privacy policy of my website. I saw in many places that people are saying that these info are collected by cookies. But how can my host set cookies? I am the one who decides what files to use for my website. I am sure i am missing a fundamental point here but what? My website is really simple standard WordPress site, without even a contact form or user registration form or commenting sections so i collect nothing from anyone and all there is collected is the standard info my host collects but how ? I will ask them too but before that i wanted to ask you webmasters, to be more knowledgeable....

1 Answer 1

1

We can only provide general advice without knowing the specifics - but I'm pretty sure this will cover > 95% of hosts.

The web host logs are logged in the web server which can be configured, but typically include IP address, URL viewed, URL which was clicked on to get to that URL (referer/referrer), bytes of the request, port number, date and time and browser reported. None of this information requires cookies - its all part of the standard HTTP(s) negotiation and known to the server because the protocol more-or-less requires this information Some hosts will also record the time each request takes to fill - but this is less common.

It is possible to configure log files to include cookies and posted data, however this is not "out the box" configuration - and is generally of little use to your provider.

Log files are generally 1 line per web request - and a single web page will often contain multiple requests - ie a request for the page, requests for includes Javascript, requests for images, requests for CSS. This information can be parsed to produce an output with an overview - but its generally not particularly accurate because of bots (hence why people use things like Google Analytics for meaningful stats - which is a privacy concern - but nothing to do with the web host)

https://httpd.apache.org/docs/current/logs.html contains more information then you would ever want to know about how Apache - one of the foremost webservers - allows configuration of logging. https://httpd.apache.org/docs/current/mod/mod_log_config.html#logformat shows what can be configured (note there is no "all cookies" option - you would need to specify the particular cookie names you want to log - and these will differ per program - although I expect quite a bit will be standardised in Wordpress if a host really wants to.) If your hosting is using cpanel it is very likely using Apache.

https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log has similar information for nginx - the other main web server. (There are plenty of other servers, but these 2 would cover most general hosting providers). I've not used nginx much - but I get the impression its less configurable - so gives less logging then Apache (but it has other advantages - like its faster)

About cookies

To understand the below, the way a connection works when using Wordpress is roughly -

Web Browser -> Web Server -> PHP -> Wordpress

For standard hosting web hosts don't generally collect cookies. Cookies are set by the application (ie Wordpress). It is technically possible for your host to set these cookies outside the application by injecting them at the web server level but in most cases WORDPRESS is setting the cookies.

For general purpose hosting of Wordpress sites the web host does not care that you are using Wordpress - they are interested in the Web Server, and making sure it can work with PHP.

If you add Cloudflare or equivalent to the mix, things do get more complex, and Cloudflare/your Caching provider may add additional Cookies to help with routing, monitoring and controlling traffic. That is generally outside the purview of your web host though.

2
  • Thanks. Some parts of your answer are difficult for me to understand but basically you are saying that my web host which is a widely used standard shared hosting wouldn't need cookies to collecr that info and it collects them by itself right? So the reason that i saw many privacy policies mention cookies to collect these info must be because they must be doing something deliberately for it, but if i am just using a basic WordPress this wouldn't apply right? So i am only using the default basic cookies that WordPress is using right?
    – upstream
    Commented Apr 23 at 10:07
  • 1
    Correct. Wordpress does use some basic cookies. wordpress.com/support/your-site-and-the-gdpr has some useful information (particularly if you are worried about GDPR compliance). If you are outside the EU, you probably don't need to worry about Wordpress cookies on a basic install from a privacy POV.
    – davidgo
    Commented Apr 23 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.