What it is

A cookie is missing one or more security flags (Secure, HttpOnly, SameSite). Without them, that cookie can be sent over plain HTTP, read by injected JavaScript, or attached to requests from other sites — each one widening how it could be stolen or misused.

How to fix it

Set Secure, HttpOnly and SameSite on every cookie your site issues. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

Your WordPress site is using cookies without enough protection, which is like sending important documents in an envelope that anyone can open. Cookies are small files that store information about visitors, like login details or preferences, and they need security flags to prevent attackers from stealing them through your browser or from other websites you visit. Right now, someone could use JavaScript code injected into your site to read these cookies, or trick you into clicking a link on another site that steals them. The fix is straightforward: you need to add three security settings called Secure, HttpOnly, and SameSite to every cookie your site creates. The Secure flag ensures cookies only travel over encrypted connections, HttpOnly prevents JavaScript from reading them, and SameSite stops cookies from being sent to your site from other domains. If you're not a developer, the easiest solution is to install a WordPress security plugin that handles this automatically—most reputable security plugins have settings that apply these protections with just a few clicks, no coding required.