From WHMCS Documentation

WHMCS uses cookies to maintain session state and store small amounts of data on visitors’ computers or devices.

Cookies are small text files stored on a device when you access most websites on the internet and are often used to improve your overall experience.

There are two types of cookie used by WHMCS:

  • Session cookies - these expire when you close your browser and do not remain on your computer.
  • Persistent cookies - these are stored long term on your computer for a defined period of time.

Below is a list of cookies created during use of the WHMCS client area along with a description of which type of cookie they are, and what purpose each serves.

  • WHMCSInstanceID - Probably the most common cookie that most PHP based websites will use. This is used to store the unique session ID for each visitor and enables variables to be remembered and passed between page loads. The cookie only contains a reference to a session stored on the web server, personal information is not stored in the user's browser. This is a session only cookie so expires as soon as the browser is closed.
  • WHMCSAffiliateID - This cookie is set when a customer is referred to you via an affiliate. It stores the ID of the affiliate that made the referral so that if an order is placed within the next 90 days following the referral, the affiliate can be credited for it. It is a persistent cookie.
  • WHMCSLinkID - This cookie is set only if you use the link tracking feature of WHMCS (Utilities > Link Tracking). It remembers the link the visitor followed to first get to your website, and is used when an order is placed to be able to associate the conversion with a link to be able to provide stats such as the conversion rate of your links. It is a persistent cookie.
  • WHMCSUID/WHMCSPW - These 2 cookies are used for the remember me functionality of the client area. They only get set should a client choose to have their details remembered so they don't have to re-login every time they visit your website. They are persistant and last for 365 days, or until logout.