“My WooCommerce Cart Keeps Emptying!” — The Cookie Exclusion Fix Nobody Tells You About (Varnish + WP Rocket)

You add a product to the cart, click over to another page, and the cart quietly drops back to 0 items. There’s no error message, no warning in the dashboard — just a cart that refuses to remember what’s in it.

I ran into this exact bug recently, and the fix wasn’t where I expected it to be. Here’s what was actually happening, and how I fixed it without killing site speed.

What’s Really Happening

The site I was working on was running Varnish, Redis, and WP Rocket together — a pretty aggressive caching stack. Great for page speed, but risky for WooCommerce if it’s not configured with the store in mind.

Here’s the part most people miss: WooCommerce relies on a few specific cookies to know that a visitor has items in their cart. If your caching layer doesn’t know those cookies are important, it ends up serving everyone the same cached, logged-out, empty-cart version of the page — including the person who just clicked “Add to Cart” two seconds ago. The cart isn’t actually gone. WordPress just never gets told it’s there.

Quick Way to Confirm It’s Caching

Before touching any settings, it’s worth confirming the theory first, since “cart resets” can have a couple of different causes.

1. Add a product to the cart.
2. Open dev tools → Application → Cookies, and check whether woocommerce_items_in_cart or wp_woocommerce_session_* actually gets set.
3. Navigate to another page and look at the response headers (X-Cache, X-Varnish-Cache, or similar).

If you see a HIT on the very next page right after adding something to the cart, that’s your culprit — the page was served from cache instead of being generated fresh for that visitor.

In my case, that’s exactly what was happening. I disabled Varnish just to be sure, and the cart started working instantly. But that’s not a real fix — the moment Varnish was off, load times shot right back up, and a live store can’t really run without it. So the actual goal became teaching Varnish and WP Rocket to leave WooCommerce’s cookies alone, rather than removing the cache layer entirely.

Cookies to Exclude for a WooCommerce Store

This is the full list I ended up excluding across both Varnish and WP Rocket. It’s worth adding all of these rather than just the cart cookie, since a couple of the others affect session state and personalization too:

• woocommerce_items_in_cart
• woocommerce_cart_hash
• wp_woocommerce_session_*
• woocommerce_recently_viewed
• wordpress_logged_in_*
• wordpress_sec_*
• wp-settings-*
• wp-settings-time-*

If you only have time to exclude one, make it wp_woocommerce_session_ — that’s the cookie that actually carries the cart contents from request to request. But excluding only that one can still leave smaller bugs behind, like an admin’s logged-in state flickering between sessions, or “recently viewed” products not updating properly. Excluding the full list avoids that.

1. Locate your VCL file, usually default.vcl. You’ll need SSH access or your hosting panel’s Varnish section to get to it.
2. Open the vcl_recv subroutine — this is where Varnish decides whether to serve a cached page or pass the request through.
3. Add a condition that bypasses the cache whenever a WooCommerce cookie is present:

vcl

   if (req.http.Cookie ~ "woocommerce_items_in_cart|woocommerce_cart_hash|wp_woocommerce_session_") {
       return (pass);
   }

4. Save the file and restart Varnish so the new configuration actually takes effect.
5. Test it by adding a product to the cart and checking the next page’s headers — you’re looking for a MISS or PASS instead of a HIT while that cookie is present.

Fix #1: Excluding Cookies in Varnish

Varnish doesn’t have a settings page like a typical plugin — you’re either editing the VCL configuration directly, or using a simplified panel if your host manages Varnish for you.

If your host manages Varnish for you and you don’t have direct VCL access, look for a “cache exclusions” or “bypass cache for these cookies” field in their panel instead. The logic is identical — it’s just exposed through a UI rather than raw config.

Fix #2: Excluding Cookies in WP Rocket

This part is a lot easier since it’s a proper settings field rather than a config file you have to edit by hand.

1. Go to WP Rocket → Settings → Advanced Rules.
2. Find the “Never Cache Cookies” field.
3. Add the cookie names, one per line:

   woocommerce_items_in_cart
   woocommerce_cart_hash
   wp_woocommerce_session_
   woocommerce_recently_viewed

4. Save the changes, then clear the WP Rocket cache so the new rule applies immediately instead of waiting for the next natural cache refresh.
5. Re-test the cart flow — add a product, move to a different page, and confirm the count actually holds this time.

The Verdict

WooCommerce and aggressive caching can absolutely coexist — you just have to be explicit about which cookies the cache isn’t allowed to touch. The cart isn’t broken; it’s getting cached out of existence, page by page.

Once Varnish and WP Rocket both knew to step aside for these specific cookies, the site kept its full speed benefits and the cart stopped resetting at the same time. No need to choose one over the other.

If you’re running a similar stack — Varnish, Redis, WP Rocket, or any combination of full-page and plugin-level caching — this exclusion list is worth checking before you go down a multi-hour rabbit hole like I did.