Site (same-site)

How it works

The registrable domain is one entry of the Public Suffix List plus the label just before it. The Public Suffix List names the endings under which anyone can register a domain, such as com or co.uk. So the registrable domain of app.example.co.uk is example.co.uk. People also call it eTLD+1.

The HTML standard calls two URLs "same site" when the scheme and the registrable domain match. It calls them "schemelessly same site" when only the registrable domain matches. Cookie rules such as SameSite use the version with the scheme, so http://example.com and https://example.com are two sites for cookies.

Site vs origin

Check	Compares	www.example.com and app.example.com
Same-origin	Scheme, full host, port	Different
Same-site	Scheme, registrable domain (no port)	Same

Browsers use the origin for script access, such as the same-origin policy. They use the site for cookies: SameSite, third-party cookies, partitioned cookies, and the Storage Access API. So a frame from a subdomain of the top page is cross-origin, but its cookies are first-party.

https://www.example.com  and  https://app.example.com   same site
https://example.com      and  https://example.com:8080  same site
https://example.com      and  http://example.com        cross-site
https://shop.example     and  https://widget.example    cross-site