webzod
account

Set SameSite on session cookies on WordPress

headers.cookies.no_samesite · effort: about an hour

Why it matters

A session cookie without SameSite relies on each browser's default, and some still send it with cross-site requests that can trigger actions as the logged-in visitor. SameSite=Lax stops that for most cross-site requests while normal links keep working.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Stage 1: identify the plugin that sets the cookie and check whether it is used in payment or single sign-on returns from other sites.
  2. Stage 2: for PHP sessions set session.cookie_samesite = "Lax" in php.ini or your host's PHP settings; for other plugin cookies, check the plugin's settings or ask its developer. Test checkout and login afterwards.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.