Skip to content
CyberVigil
Tools
Website security scanDMARC checkerSPF checkerSSL checkerSecurity headers checker
Guides
Website securityEmail securitySmall business basicsBy industryCompliance & insuranceFix guides
How it worksPricingGet started free
Fix guides

How to fix cookies missing the Secure or SameSite flag

If your scan flags cookies without Secure or SameSite, find what sets them and add the flags in your platform, PHP settings, or Apache or Nginx config.

By the CyberVigil teamHow we write and check guidesUpdated Oct 24, 20262 min read
Quick answer

This finding means your homepage sets a cookie without the Secure flag (send it only over HTTPS) or the SameSite flag (limit sending it with requests from other sites). Find what sets the cookie from its name, then turn on secure cookies in that tool, set PHP's session cookie options, or add the flags in your server config. It's a low-severity fix.

If your CyberVigil report says some cookies are missing the Secure or SameSite flag, your site isn't broken. It's a low-severity finding about how a cookie is labeled, and the fix happens wherever that cookie is created.

Your report lists the cookie names. Keep them handy, since they're the main clue to what sets each one. You can re-run the scan below at any point to see the current list.

  • Free check
  • No signup
  • No changes to your website

What does this finding mean?

A cookie is a small piece of data your website asks the visitor's browser to store, such as a login session, a shopping cart or a preference. When the server creates one, it can add flags that tell the browser how to handle it.

Our scan reads every cookie your server sends with your homepage and checks two of those flags. If any cookie is missing either one, we show "Worth improving" and list the cookie by name.

What do Secure, SameSite and HttpOnly do?

FlagWhat it tells the browserChecked by our scan
SecureOnly send this cookie over HTTPS, never plain HTTPYes
SameSiteDon't attach this cookie to most requests started by other websites. Lax is the usual valueYes
HttpOnlyDon't let JavaScript on the page read this cookieRecorded, not graded

Without Secure, a cookie can travel unencrypted if a visitor ever reaches an http:// page. Without SameSite, another site can trigger requests to yours that carry the visitor's cookie, which is the basis of cross-site request forgery. Chrome and Edge treat a cookie with no SameSite value as Lax by default, but not every browser does, so it's better to set it.

For a login or session cookie, aim for all three: Secure; HttpOnly; SameSite=Lax.

Which software sets my cookies?

The cookie name usually gives it away. Some common ones:

  • PHPSESSID comes from PHP's built-in sessions, which many plugins and custom sites use.
  • Names starting with wp_ or wordpress_ come from WordPress, and woocommerce_ or wp_woocommerce_session_ from WooCommerce.
  • Names starting with AWSALB or AWSELB come from an Amazon load balancer your host uses.
  • Cookies tied to a booking, chat or popup tool usually include that tool's name.

If the name doesn't tell you, search it alongside your platform's name, or ask your developer or hosting company.

See all your website and email settings

Run a free scan for a plain-English report on cookies, security headers, HTTPS and your email protection.

  • Free check
  • No signup
  • No changes to your website

How do I add the flags?

Fix the flags where the cookie is created. Choose the tab that matches what sets yours.

Instructions for PHP / WordPress

  1. 1For PHPSESSID and other PHP session cookies, set the three session options below in php.ini, or ask your host to set them. Many hosts offer a PHP options or MultiPHP INI Editor page in cPanel.
  2. 2For a cookie created by a WordPress plugin, check the plugin's settings for a secure cookie option, then contact its developer if there isn't one.
  3. 3Make sure Settings → General uses https:// for both site addresses, since WordPress only marks its login cookies Secure on HTTPS.
php.ini
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

How do I check that it worked?

  1. Clear cookies for your site, or open a private window.
  2. Reload your homepage, open your browser's developer tools, and look under Application → Cookies (Chrome or Edge) or Storage → Cookies (Firefox). The Secure and SameSite columns should be filled in.
  3. Test your login, cart and checkout to make sure nothing logs you out unexpectedly.
  4. Re-run your scan. The cookie protection result should show "Looks good."

What should you do next?

Common questions

Is a cookie without these flags dangerous?

Usually not on its own, which is why our scan rates it low severity. The risk depends on what the cookie holds. A login or session cookie without Secure or SameSite is worth fixing soon. A cookie that only remembers a language choice matters much less.

Why doesn't the scan show my analytics cookies?

We read the cookies your server sends with the homepage. Cookies created later by JavaScript, such as most analytics and ad cookies, don't appear in that response, so this check doesn't cover them.

Should I use SameSite=Lax, Strict or None?

Lax suits most cookies. It keeps the cookie on normal links to your site but leaves it off most requests that other sites trigger. Strict can log people out when they arrive from a link elsewhere. None is only for cookies that must work inside other sites, and MDN says it requires the Secure flag.

What does HttpOnly do, and does the scan check it?

HttpOnly stops JavaScript on the page from reading the cookie, which protects login sessions if a malicious script gets onto your site. Our scan records it but only grades Secure and SameSite. Add HttpOnly to any cookie your site's own scripts don't need to read.

The cookie comes from a service I don't control. What can I do?

If a cookie comes from your host's load balancer, your CDN or a third-party service, ask that company's support whether they can set the flags. If they can't, you can leave this finding as it is. It's a low-severity item and doesn't stop you fixing everything else.

Sources

  1. Set-Cookie (MDN Web Docs)
  2. Cookie security (MDN Web Docs)
  3. SameSite cookies explained (web.dev)
  4. Session Management Cheat Sheet (OWASP Cheat Sheet Series)
  5. Runtime configuration: sessions (PHP Manual)
  6. Module ngx_http_proxy_module (nginx.org)

Related guides and tools

How to add missing security headersYour WordPress security checklistSecurity headersFree website security scan
Next steps

Keep building a safer business

Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.

Run a free scanExplore free tools