The answer to this question is pretty simple - cookies can only be set for the domain that you're visiting, so the whitelist simply needs to include the same domain as is in your address bar (OK, that might not be true for sites using some cheapskate frame-based "forwarding", but that's not us) Moreover, only wikimedia's projects are hosted on the "wikipedia.org" domain, so you should be able to just whitelist ".wikipedia.org", and voilá you can log in happily. Well, perhaps you need to either reconfigure, or get to know the interface of, your software, since you will find many login-based websites severely limited if you can't work out how to unblock their cookies. Recent versions of Mozilla, for instance, show an icon in the bottom right of the window when a cookie has been auto-blocked; clicking it reveals (IIRC) a dialog offering to whitelist the site that tried to set the cookie. I don't think it's a website's place to second guess what rules are being applied by the software (whitelist, blacklist, warning dialog, automatic filtering, who knows what else?) and instruct users to change them. Finally, I just want to mutter a bit about the unnecessary fuss people make about cookies - they can't actually retrieve any more information than they store, after all! Yes, I know, advertisers use them to see that the same computer is accessing different sites that carry banners from the same service - although some browsers let you block cookies from all 'secondary' connections like this, I think. But even that is only a tiny bit more reliable for them than just using your IP address - especially as more people get broadband, often with a fixed IP; and IPv6 promises to give everyone a unique address anyway - so if that takes off, the advertisers won't need cookies at all! Generally, cookies seem far more useful (for keeping track of information like "I am logged in") than harmful; but each to their own, I guess... -- Rowan Collins BSc [IMSoP]