If a big share of your traffic is on iPhone, this one matters. Safari’s Intelligent Tracking Prevention (ITP) cuts the life of many tracking cookies down to as little as 7 days, and sometimes 24 hours. So a customer who clicks your ad on Monday and buys the next week can look like a brand new visitor. Your ad platform loses the credit.
Why a simple subdomain is not always enough
A custom subdomain (Blog 1) gives you first-party cookies. But Safari also looks at the IP address. If ss.yourstore.com points to a different server IP than yourstore.com, Safari can still treat those cookies as short-lived. That is the gap these fixes close.
Your three options
| Option | How it works | Effort |
|---|---|---|
| Same origin | Tracking runs on yourstore.com/metrics, same domain and IP as the site | High: needs Cloudflare or nginx rules |
| Own CDN | Route your tracking subdomain through the same CDN as your website so IPs match | Medium |
| Cookie Keeper (Stape power-up) | Stores key cookies and restores them when Safari deletes them | Low: switch it on |
Step by step: Cookie Keeper (the easy path)
- Open your container on Stape → Power-ups → Cookie Keeper.
- Turn it on and choose which cookies to protect. Start with
_ga,_fbp,_fbc,_gcl_awand_ttp. - Pick a storage method. Follow Stape’s recommendation for your setup.
- Publish and test in Safari. Visit the site, note your
_gavalue, come back later and check it stayed the same.
Step by step: Same origin (the strongest path)
- Choose a path, for example
/metrics. - In Cloudflare, create a rule that sends
yourstore.com/metrics/*to your Stape custom domain, with the right Host header. - Or in nginx, add a
location /metricsblock that proxies to your sGTM domain. - Set the same origin path in Stape so GA4 requests work correctly.
- Update
server_container_urlin your Google tag tohttps://yourstore.com/metrics. - Test that requests return 200 and cookies are set on your main domain.
Mistakes to avoid
- Assuming the subdomain alone fixes Safari. It helps, but not fully.
- Using Own CDN with same origin. Stape advises against combining them. Pick one approach.
- Path mismatch. The page and
server_container_urlmust use the exact same hostname and path. - Not checking consent. Longer cookies still need the user’s consent where law requires it.
Why clients notice
A pattern I see with stores whose traffic is mostly mobile: returning-customer numbers look oddly low in GA4, and Meta attribution windows feel “short”. After fixing cookie life, returning users are recognised again and attribution looks more like reality.
Bottom line
If you cannot do same origin, switch on Cookie Keeper. Either way, do not leave Safari users on 7-day cookies.
Source reading: Stape — a new way to set up a custom domain, Stape — same origin approach