Domain scope is the part of a domain hierarchy where a cookie is allowed to be sent. A cookie set for a broad scope such as .example.com may be included on requests to multiple subdomains, while a narrower host-only cookie stays tied to one host. Browsers use this rule to decide whether a stored token should travel with a request.
This matters in cyber security because scope directly affects how far a browser identifier can spread. In ad tech and analytics, broad scope helps systems recognize the same browser across related services. In attacks, an overly broad scope can expose a cookie to more subdomains than intended, increasing the impact of subdomain compromise, misconfiguration, or cross-site correlation. Defenders reduce risk by limiting scope to the smallest practical host, combining it with Secure and HttpOnly, and reviewing whether cross-subdomain sharing is actually needed.