Cookie missing Secure, HttpOnly or SameSite flags

What it is

A cookie is missing one or more security flags (Secure, HttpOnly, SameSite). Without them, that cookie can be sent over plain HTTP, read by injected JavaScript, or attached to requests from other sites — each one widening how it could be stolen or misused.

How to fix it

Set Secure, HttpOnly and SameSite on every cookie your site issues. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.