Safari 27.2 Fixes a 7-Day Cookie Cap on CNAME Domains

By
Safari 27.2 Fixes a 7-Day Cookie Cap on CNAME Domains
Safari 27.2 Fixes a 7-Day Cookie Cap on CNAME Domains
Affiliate disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you. Full disclosure

Safari 27.2 fixes a bug that capped cookies set by a site’s own page response at seven days when the hostname was a CNAME alias, WebKit said Monday.

If you run a Shopify store, that sentence touches your setup, because Shopify’s help center tells merchants to point the www subdomain at shops.myshopify.com with a CNAME record. Neither WebKit nor PPC Land says any Shopify store was hit, so nobody has proven damage yet. Safari still carries 46.38% of US mobile browser traffic per StatCounter’s September 2026 data. That is why readers of Ecommerce Paradise who sell $1,500 to $10,000 products should spend ten minutes on it.

Below: what WebKit changed, how Safari ended up with a seven-day rule for CNAME hosts, what it could mean for carts and attribution on a store with a long buying cycle, and six checks to run before Black Friday traffic arrives.

Platforms rewrite your tracking rules overnight, so build the store on a legal entity that stays put: form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. Northwest has spent 25 years doing one job, which is why it beats the cheap formation sites that upsell you after checkout. Form your LLC with Northwest →

Safari 27.2 Fixes the Seven-Day Cap on CNAME Cookies

WebKit published its “WebKit Features for Safari 27.2” post on October 26, 2026, written by Jen Simmons. The post says the release includes 20 bug fixes, alongside updates to Customizable Select and Grid Lanes. Under Networking, one entry reads: “Fixed cookies set by a top-level navigation’s own response being capped to a seven-day lifetime.” WebKit tracks it as bug 183787115, per the WebKit release post.

The fix applies when the site’s hostname is a CNAME for a different registrable domain, according to the same post. The 27.2 release covers iOS 27.2, iPadOS 27.2, visionOS 27.2, macOS 27.2 Golden Gate, macOS Tahoe, and macOS Sequoia. On the two older macOS versions, Safari can be updated on its own.

PPC Land’s Luis Rijo reported the entry on October 27 and listed what it does not cover. Per PPC Land, the fix leaves cloaked tracking subdomains alone, such as an sst.example.com endpoint. It also leaves the IP address cloaking rule added in Safari 16.4 and the seven-day cap on JavaScript-set cookies untouched.

PPC Land says the affected cookies are the ones that carry logins, shopping baskets, consent records, or some server-side visitor IDs. Visitors who came back after more than a week could have lost them. The outlet also says WebKit does not state when the bug began, which Safari versions had it, how many sites were hit, or what happens to cookies already stored with the shorter expiry.

Now the Shopify side, which is reported fact from Shopify’s own documents and not a finding about this bug. For the root domain, Shopify’s domain setup instructions tell merchants to create an A record at 23.227.38.65. For the www subdomain, they tell merchants to create a CNAME record pointing to shops.myshopify.com.

Shopify’s cookie policy lists the storefront cookies and their lifetimes. The cart cookie lasts two weeks, and so does cart_currency. The _shopify_essential cookie, which holds session and checkout data, lasts one year. The _shopify_analytics and _shopify_marketing cookies also last one year.

Put the two documents next to each other and a two-week cart cookie sits right beside a seven-day cap. That is a coincidence of numbers, not a confirmed cause and effect. Nobody has published a test showing the cap shortened a Shopify cookie.

Why Safari Caps Cookies at Seven Days on CNAME Domains

The CNAME rule is not new. On November 12, 2020, WebKit’s John Wilander wrote that “ITP now caps the expiry of cookies set in so-called third-party CNAME-cloaked HTTP responses to 7 days,” in a post titled CNAME Cloaking and Bounce Tracking Defense. It shipped in Safari 14. The target was trackers that persuaded site owners to point a subdomain at a third party so the browser would treat the tracker as first-party.

That is the intended rule. A CNAME to a tracking vendor gets seven days. A CNAME to your own platform’s servers was never supposed to count, because the cookie is not being set by a tracker pretending to be you.

The older seven-day limits have a history too. Analytics consultant Simo Ahava wrote in November 2022 that Safari began capping JavaScript-set cookies at seven days in 2019 with ITP 2.1. He wrote that WebKit later replaced that expiry cap with a rule deleting script-writable storage after seven days of browser use without user interaction. In the same post, he described a test build that would limit server-set cookies from third-party IP subnets and CNAMEs to seven days, per his write-up.

PPC Land argues the 27.2 bug went beyond WebKit’s published 2020 definition, since it hit a site’s own top-level response. That is the outlet’s interpretation, not WebKit’s stated position. WebKit’s own entry calls it a fix, which fits the same reading.

The timing is also noisy. This is the second Safari tracking story in a week. WebKit announced on October 19 that Safari 27 blocks third-party identity resolution services, which I covered in my Safari 27 identity resolution breakdown. Earlier, iOS 27 shipped on September 14, and I wrote about the Trade Desk ad domain block in my iOS 27 Trade Desk post.

Do not merge these into one story. PPC Land says WebKit’s 27.2 post is silent on the ad-domain issue tied to bug 324771, which The Trade Desk filed on September 21, 2026. It says it cannot confirm whether production iOS 27.2 includes the change Apple tested in a beta build. The cookie fix and the ad-domain block are separate items.

The counterpoint is simple. This is a bug fix in a narrow case, and the fix helps sites. If you were never affected, 27.2 changes nothing for you. If the cap did touch your cookies, it is going away without any action from you, though cookies already stored with the short expiry may persist until they lapse. PPC Land says the cleanup question is unanswered.

What the Safari Cookie Bug Could Cost a High-Ticket Store

My read is that most Shopify stores had little to worry about here, and a specific kind of store had more than it realized. The specific kind is a store with a long buying cycle, a lot of Safari traffic, and a primary domain on www.

Start with the domain question, because it decides whether this story is about you at all. WebKit’s fix describes a hostname that is a CNAME for a different registrable domain. A store whose primary domain is the bare yourstore.com uses the A record, so on paper it does not match that description. A store whose primary domain is www.yourstore.com does match it. That is my reading of two documents, and neither one states it.

Next, the buying cycle. High-ticket buyers do not behave like a $40 impulse shopper. They compare four stores, call a rep, ask a spouse, and wait on financing. A cart cookie that dies on day seven hurts a buyer who returns on day nine, and a cart cookie that lives two weeks as Shopify designed it does not. If you sell furniture, powersports gear, or mobility equipment, that return trip is your normal customer.

Here is hypothetical math, labeled as such, not data from any store. Say a store gets 20,000 US mobile sessions a month. At 46.38% Safari, that is 9,276 Safari sessions. At a 0.5% conversion rate that is about 46 orders, and at an $1,800 average order that is roughly $83,000 a month from Safari. If 12% of those buyers need more than seven days between first visit and purchase, that is about five orders and $9,000 a month sitting on a cookie that has to survive.

Even then, the sale is rarely lost outright. A buyer who returns without the cart cookie usually finds the product again and checks out. What breaks is the connection between the first visit and the order. The order lands as direct traffic, the Google Shopping click that started it gets no credit, and your ROAS report looks worse than reality. Stores that cut winning campaigns on bad numbers do the most damage to themselves.

That is why I treat measurement drift as the real cost. I wrote about the same risk in my guide on turning Google Shopping clicks into sales, where the whole point is knowing which clicks produce the order. A broken cookie chain makes you guess.

The scenario thresholds below are my own rules of thumb, not industry standards. If Safari is under 25% of your sessions and most buyers purchase within a week, run the ten-minute test and move on. If Safari is 40% or more and your buyers routinely take two weeks or longer, run every check in the list this week. If your primary domain is the bare domain on the A record, your exposure to this exact bug is likely close to zero, but the test still tells you what your cookies do.

One more trap. The fix does not cover cloaked tracking subdomains, per PPC Land. If your agency set up server-side tagging on a CNAME subdomain, 27.2 gives you no relief there. The seven-day cap on that kind of endpoint is the rule WebKit meant to enforce in 2020, so plan around it. My post on the Google tag gateway lift claim covers one server-side option. My write-up on Google Tag Manager skipping extra gtag.js covers another.

Consent records are the other place cookie lifetimes bite. A consent cookie that expires at day seven re-prompts a returning Safari visitor in a week, well before the four-month re-ask wait in the draft I covered in my EU Council cookie consent post. If you use Termly for the banner, check how long its consent record lives.

The durable fix is not a cleverer cookie. It is capturing an email address early so that a returning buyer is identified by what they typed, not by a browser file Apple controls. That is why your email platform matters more than your pixel. Klaviyo can tie a browsing session to an email once the visitor identifies themselves, and your abandoned-cart flow then does the remembering for you. Omnisend works the same way.

This is the kind of maintenance that eats a store owner’s week. Cookie lifetimes, DNS records, consent banners, and attribution checks all live in the gaps between apps. If you would rather have someone own that layer, my team builds and runs high-ticket stores through the turnkey service, so the checks happen without you opening a browser inspector.

Want to compare your Safari cookie test results with other store owners and me inside the community? Join the Skool community →

6 Safari Cookie Checks to Run Before Black Friday

Run these in order. The first two take ten minutes and tell you whether the rest matter.

  1. Open Settings, then Domains in your Shopify admin and write down your primary domain. Bare domain on the A record means low exposure to this bug. A www primary on the CNAME to shops.myshopify.com means you match WebKit’s description. If your domain is registered at Namecheap, the A and CNAME records live in its DNS panel.
  2. Update a Mac or iPhone to Safari 27.2, add a product to your cart, then open Safari’s Web Inspector, go to the Storage tab, and read the expiry on the cart cookie. Shopify’s published lifetime is two weeks. A seven-day expiry on a build without the fix would confirm the bug touched you. If you cannot test an older build, a two-week expiry on 27.2 at least tells you the fix works for your store.
  3. Pull your analytics for the last 60 days and split returning-visitor conversions by Safari and Chrome. Look for a step change after iOS 27 shipped on September 14. Write down your numbers now, because Meta’s pixel counting change starts November 12 and will move your baseline, as I explained in my Meta Pixel conversion counting post.
  4. Ask whoever runs your tracking whether any server-side tagging endpoint sits on a CNAME subdomain. If yes, assume a seven-day cap on that endpoint and keep a second identifier, such as a hashed email, on the order.
  5. Move email capture earlier. Add a “send me this quote” or “email me this cart” step on high-ticket product pages, and log the lead source in HubSpot so a buyer who calls two weeks later still traces back to the first click. For phone and chat leads, Gorgias can keep the conversation tied to the customer record.
  6. Check how long your consent cookie lives and what your banner does on a return visit after eight days. If the banner reappears, fix the expiry in your consent tool before Black Friday ad volume lands, and use my Termly store setup guide if you need the steps. Then run the rest of my high-ticket Black Friday store stress test.

Explore Turnkey Builds for service details and pricing. Email me with questions before getting started.

If you are still deciding on a niche, start with my free beginner guide. Then work through the high-ticket niches list.

Frequently Asked Questions

Did Safari’s seven-day cookie bug hit Shopify stores?
Nobody has shown that it did. PPC Land does not name Shopify, and WebKit does not say how many sites were affected. The fix targets hostnames that are CNAMEs for a different registrable domain, which on paper includes a www primary domain pointing at shops.myshopify.com.

Which cookies does Shopify set, and for how long?
Per Shopify’s cookie policy, the cart and cart_currency cookies last two weeks, while _shopify_essential, _shopify_analytics, and _shopify_marketing last one year. I covered how that fits a store’s reporting in my guide to the best Shopify analytics apps.

Do I need to change my DNS because of Safari 27.2?
No. The release fixes Safari’s behavior, so your records do not need to change. Check which hostname is your primary domain so you know whether you match the case WebKit described.

How does this relate to the Safari 27 identity resolution block?
They are separate. The October 19 announcement blocks third-party identity resolution services, while the 27.2 entry fixes a cookie lifetime bug. My identity resolution audit checklist covers the ad side.

Will this change my Meta or Google ad reporting?
Only if returning Safari buyers lost their cookies before purchase. Compare Safari and Chrome returning-visitor conversions, and check Meta’s changes in my post on product browsing in existing ads, which flips on October 28.

Is high-ticket dropshipping hit harder than low-ticket stores?
Usually yes, because the buying cycle is longer and a cookie has more time to expire. If you are new to the model, my guide on what high-ticket dropshipping is explains why those buyers take time.

What should I do first if I only have ten minutes?
Check your primary domain, then read the cart cookie expiry in Safari’s Web Inspector on 27.2. Those two checks tell you whether the other four are urgent.

Want my team to build and run your high-ticket store so cookie lifetimes and attribution checks stop landing on your desk? See the turnkey done-for-you service →

Do the primary domain check today and the cookie test this week. If the numbers look off, tell me what you find. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

Related Articles

If this was useful, these go deeper:

Share on Facebook
Post on X
Save
Share