Secure cookies

Secure cookie flags help keep session cookies on HTTPS and less reachable from JavaScript. That reduces some XSS and cookie-theft paths. Your site must already work over HTTPS.

One-click fix (Pro)

1. Go to Security Ninja → Fixes.
2. Enable Secure Cookies.
3. Security Ninja writes the matching @ini_set lines into wp-config.php.

Manual setup

Add these lines to wp-config.php above the “That’s all, stop editing!” line:

@ini_set( 'session.cookie_httponly', true );
@ini_set( 'session.cookie_secure', true );
@ini_set( 'session.use_only_cookies', true );

• session.cookie_httponly: reduces JavaScript access to the session cookie.
• session.cookie_secure: send the cookie only over HTTPS.
• session.use_only_cookies: avoid URL-based session IDs.

Verify

1. Clear browser cookies for the site.
2. Log in again over HTTPS.
3. In browser developer tools, confirm Secure and HttpOnly where your stack sets them.

Related: Fixes overview.