---
title: Secure cookies
canonical: https://wpsecurityninja.com/docs/security-fixes/secure-cookies/
---
Secure cookie flags help keep session cookies on HTTPS and less reachable from JavaScript. That reduces some XSS and cookie-theft paths. Your site must already work over HTTPS.

![Secure Cookies enable or disable](https://wpsecurityninja.com/media/2022/01/secure-cookies-enable-or-disable.webp)

## One-click fix (Pro)

1. Go to **Security Ninja → Fixes**.
2. Enable **Secure Cookies**.
3. Security Ninja writes the matching `@ini_set` lines into `wp-config.php`.

## Manual setup

Add these lines to `wp-config.php` above the “That’s all, stop editing!” line:

```php
@ini_set( 'session.cookie_httponly', true );
@ini_set( 'session.cookie_secure', true );
@ini_set( 'session.use_only_cookies', true );
```

* `session.cookie_httponly`: reduces JavaScript access to the session cookie.
* `session.cookie_secure`: send the cookie only over HTTPS.
* `session.use_only_cookies`: avoid URL-based session IDs.

## Verify

1. Clear browser cookies for the site.
2. Log in again over HTTPS.
3. In browser developer tools, confirm `Secure` and `HttpOnly` where your stack sets them.

Related: [Fixes overview](https://wpsecurityninja.com/docs/security-tests/fixes/).