webzod
account

Make session cookies HttpOnly on WordPress

headers.cookies.no_httponly · effort: about an hour

Why it matters

Scripts on the page can read a session cookie without HttpOnly, so any cross-site scripting bug lets an attacker steal the login. HttpOnly hides the cookie from JavaScript while the browser still sends it with requests.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. WordPress's own login cookies are already HttpOnly, so the cookie comes from a plugin or PHP sessions. Check that no front-end script needs to read it.
  2. For PHP sessions (PHPSESSID) set session.cookie_httponly = 1 in php.ini or your host's PHP settings; for other plugin cookies, check the plugin's settings or ask its developer. Test logging in afterwards.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.