What is the incap_ses_* cookie?
This cookie is set to allow a visitor to receive site content from one out of multiple servers as the visitor browses the site. This allows the visitor's session to be maintained.
Our October 2026 scan found it on 24 sites (1% of the 2,450 we scanned), set before any consent.
- Purpose
- Functional
- Belongs to
- Imperva
- Set as
- First-party on 92% of sites, third-party on 8%
- Typical lifetime
- Session (vendor says: session)
- Name
- A family of cookies: the part after incap_ses_ varies by site or account.
Sites that set incap_ses_* before consent
The highest-ranked 24 of 24 sites.
- digicert.com1 tracking company
- dnsmadeeasy.com1 tracking company
- apa.org4 tracking companies
- elconfidencial.com6 tracking companies
- acs.org1 tracking company
- primis.tech11 tracking companies
- proofpoint.com3 tracking companies
- msu.edu10 tracking companies
- accor.com2 tracking companies
- aarp.org30 tracking companies
Show 14 more sites
- bt.com3 tracking companies
- thawte.com4 tracking companies
- familysearch.org0 tracking companies
- rapidssl.com2 tracking companies
- cox.net0 tracking companies
- unfccc.int5 tracking companies
- sonicwall.com8 tracking companies
- caissedesdepots.fr0 tracking companies
- aaa.com1 tracking company
- mo.gov2 tracking companies
- nj.gov4 tracking companies
- powerschool.com1 tracking company
- channelnewsasia.com24 tracking companies
- gamestop.com6 tracking companies
How to stop it
Declining non-essential cookies in a site's consent banner should stop incap_ses_* being set on later visits. Blocking third-party cookies in your browser settings stops the third-party kind everywhere, and clearing cookies for a site removes any it already set.
Description from the Open Cookie Database (Apache 2.0).
Understanding this page
- How cookie lifetimes work, and why a 13-month _ga matters
What a cookie's "expires" field actually controls, why Google Analytics ships a 2-year default that many sites cut down to 13 months, and how Safari's 7-day cap on script-set cookies changes the picture.
- First-party vs third-party cookies (and why "first-party" still tracks you)
What the distinction actually means technically, why browsers only block one of the two, and how CNAME cloaking, server-side tagging and cookies like _ga let sites keep tracking under their own domain.
- How to block or limit trackers
Browser privacy settings, content blockers, Global Privacy Control and clearing cookies compared honestly — what each one actually stops, what it doesn't, and what it costs you in return.