webzod
account

Add the Secure flag to cookies on WordPress

headers.cookies.no_secure · effort: about an hour

Why it matters

A cookie without Secure is also sent over plain http, where anyone on the network can read it and, for a session cookie, take over the visitor's account. Secure keeps it to HTTPS connections.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Stage 1: set WordPress Address and Site Address to https:// (Settings, General). WordPress marks its own login cookies Secure once the site runs on https.
  2. Stage 2: other session cookies usually come from plugins. PHP sessions (PHPSESSID) take their flags from php.ini (lines below; ask your host if you cannot edit it); for other plugin cookies, check the plugin's settings or ask its developer. Test logging in and checkout afterwards.
php.ini 
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.