WooCommerce

A generator meta tag naming WooCommerce — weight 95.

A `woocommerce_` or `wp_woocommerce_session` cookie — weight 70.

A `wc-ajax=` endpoint in the markup — weight 60; WooCommerce asset references — weight 55.

WooCommerce runs on WordPress, so both are reported, each from its own evidence.

WooCommerce's caching documentation lists `woocommerce_cart_hash` and `woocommerce_items_in_cart`, both session cookies that help it know when the cart changes.

It lists `wp_woocommerce_session_`, lasting two days, which holds a unique code per customer so the cart can be found in the database.

These are functional cookies tied to the cart. How they are classified for consent purposes is a legal judgement, not something a scan decides.

An audit reports their flags — Secure, HttpOnly, SameSite — and whether they are set before any interaction.

The documentation says the cart, checkout and account pages must be excluded from caching, because they display information specific to the current customer.

A shared cache that stores one of those pages can serve one customer's cart or details to another.

It also advises excluding the WooCommerce cookies from caching rules, and gives rules for common caching plugins and for Varnish.

From outside, the cache headers of those pages and the CDN's cache status show whether they are being stored.

The guide notes that many caching plugins already exclude these pages, and asks for the exclusion to be set explicitly where they do not.

The checkout page's static signals on a phone: HTTPS, field types, autocomplete, viewport.

Product structured data, including the currency declared against the currency displayed, and review markup only where reviews exist.

Product descriptions and category pages found during the crawl.

Marketing tags and their relationship to the consent mechanism, and whether order emails can be verified at all — which they cannot from outside.

Payment gateways and whether a payment completes.

Stock, pricing rules, taxes and shipping calculations.

Whether order emails are sent, which is only observable from inside the shop.

Extensions that add nothing to public pages.

WooCommerce's caching guide gives rules for several caching layers: it states WP Super Cache is natively compatible and does not cache the cart, checkout or account pages by default, and it asks WP Rocket users to exclude those pages in the plugin's settings.

For Varnish, the guide's example rules pass cart, account and checkout URLs to the backend and do the same for any URL containing `?add-to-cart=`.

Add-to-cart links change state for the visitor who follows them, so a cached response to one is wrong for everyone else.

It also advises excluding `_wc_session_` from database caching where a host or plugin offers it.

An audit sees the cache headers and cache status of the pages it crawls; the cache layer's own rules are configured and verified where it runs.