wordpress_apbct_antibot cookie

Issue: CleanTalk always sets wordpress_apbct_antibot in wp-admin. WP Engine treats any cookie whose name contains wordpress_ as logged-in and skips Varnish. After a dashboard visit, that session cookie (path=/) is sent on logged-out frontend requests → cache miss.

Issue: CleanTalk always sets wordpress_apbct_antibot in wp-admin. WP Engine treats any cookie whose name contains wordpress_ as logged-in and skips Varnish. After a dashboard visit, that session cookie (path=/) is sent on logged-out frontend requests → cache miss.

Anti-Crawler being off does not stop this. The checkbox only skips the frontend firewall module.

Always-on setter (admin only; no sfw__anti_crawler check):

// Crunch for Anti-Bot
add_action('admin_head', 'apbct_admin_set_cookie_for_anti_bot');
// ...
function apbct_admin_set_cookie_for_anti_bot()
{
    global $apbct;

    if ( $apbct->data['key_is_ok'] ) {
        echo
            '<script ' . (class_exists('Cookiebot_WP') ? 'data-cookieconsent="ignore"' : '') . '>
                var ctSecure = location.protocol === "https:" ? "; secure" : "";
                document.cookie = "wordpress_apbct_antibot=' . hash('sha256', $apbct->api_key . $apbct->data['salt']) . '; path=/; expires=0; samesite=lax" + ctSecure;
            </script>';
    }
}

Loaded whenever is_admin():

if ( is_admin() || is_network_admin() ) {
    require_once(CLEANTALK_PLUGIN_DIR . 'inc/cleantalk-find-spam.php');
    require_once(CLEANTALK_PLUGIN_DIR . 'inc/cleantalk-admin.php');

What the setting actually gates (frontend only):

    if ( $apbct->settings['sfw__anti_crawler'] && $apbct->stats['sfw']['entries'] > 50 ) {
        $firewall->loadFwModule(
            new \Cleantalk\ApbctWP\Firewall\AntiCrawler(