PHP Cookies Explained: A Practical Guide

Last updated: October 14, 2026

If you have ever wondered why a website seems to remember you between page loads, the answer usually comes down to cookies. PHP gives developers a straightforward toolkit for creating, reading, and deleting cookies through a built-in function called setcookie(). It is one of those small features that quietly powers a huge amount of the web, and understanding how it works makes you a more effective developer whether you are building personal projects or working with backend APIs.

Quick take

• PHP uses the setcookie() function to create and modify cookies in web responses.
• A cookie needs at least a name; value, expiry, path, domain, secure, and httponly flags are optional.
• Cookies live in the user's browser and travel back to the server on later requests.
• To delete a cookie, developers set its expiry to a moment that has already passed.
• You read a stored cookie through the PHP superglobal $_COOKIE['cookiename'].
• The reference walks through creating, retrieving, and removing a cookie with short code samples.

How cookies work

The cookie mechanism follows a simple three-step handshake. First, the web browser sends a request to the server. Second, the server responds and includes a Set-Cookie header if it wants to store something. Third, on every subsequent request, the browser sends that cookie back automatically.

PHP sits at the server end of this exchange. When you call setcookie(), PHP adds the cookie to the response headers. The browser receives it, stores it locally, and tucks it into future requests. That loop lets a server say, "ah, I have seen this visitor before," without requiring a full login each time.

Creating and reading cookies

The setcookie() method takes several parameters. Only the cookie name is required—all others are optional.

“`

<?php

$cookie_name = "mycookie";

$value = "A small piece of information";

$expiry = time() + 24 * 60 * 60; // 24 hours from now

Setcookie($cookie_name, $value, $expiry);

Echo $_COOKIE['mycookie'];

?>

“`

This example sets a cookie that expires in one day. The name identifies the cookie; the value holds whatever data you want to persist; the expiry tells the browser when to discard it.

To retrieve a cookie, PHP provides the superglobal $_COOKIE['cookiename']. On the next request where the browser sends the cookie, $_COOKIE['mycookie'] returns the stored value.

Deleting a cookie

Here is the trick that catches beginners: you do not remove a cookie from PHP. You push its expiry into the past, and the browser discards it on the next request.

“`

<?php

$expiry = time() – 24 * 60 * 60; // 24 hours ago

Setcookie($cookie_name, $value, $expiry);

?>

“`

Calling setcookie() again with the same name but a past expiry retires the cookie. This is the only way to "delete" it.

Who should care

Our analysis

The trade-off is honest: cookies are simple, require no database, and work across every browser and platform. They are also tiny, browser-stored, and visible to anyone with device access. The httponly and secure flags exist precisely because cookies were never designed to hold secrets.

Compared with JWTs and OAuth tokens, cookies feel old-school. But for straightforward "remember me" and preference jobs, that simplicity is an asset. You can read them, clear them, and explain them in two sentences. In a world that keeps inventing complex state solutions, the humble cookie still earns its place.

Bottom line

PHP cookies are not glamorous, but they are the right tool for lightweight state on the web. The setcookie() function and the $_COOKIE superglobal are honestly all you need to start.

TAKEAWAY:

• Use cookies for small, transparent bits of state, not for anything sensitive you would not want sitting in a browser file.
• Practice the delete trick now: setting an expiry in the past is how you actually remove a cookie.
• Keep security in mind—set httponly and secure flags when cookies handle anything beyond basic preferences.