How to fix insecure cookie on Webflow

Steps for Webflow

1. Webflow manages its own session cookies at the platform level — contact Webflow support for flags on cookies set by Webflow itself.
2. For cookies set in custom JavaScript (via Webflow's Embed blocks or Project Settings → Custom Code), move cookie creation to a serverless backend (e.g. Cloudflare Workers, Netlify Functions) and set the Set-Cookie response header with all three flags there.
3. In Webflow Designer: go to Project Settings → Custom Code and audit any document.cookie assignments in <script> blocks; remove them and replace with a server-side approach.
4. If using Webflow Memberships (beta/released), test login cookies in DevTools and report missing flags to Webflow support.

What is insecure cookie?

Every cookie your store sets can carry optional security flags that tell the browser how to protect it. The three most important are: *HttpOnly* (JavaScript on the page cannot read the cookie — so a malicious script injected into your site cannot steal it), *Secure* (the cookie is only ever sent over HTTPS, never plain HTTP), and *SameSite* (the cookie is not sent along with cross-site requests, blocking a class of attack called Cross-Site Request Forgery, or CSRF). A cookie missing any of these flags is being sent to your customers' browsers without those protections in place.

Without HttpOnly, a single piece of injected JavaScript — from a compromised ad, a third-party widget, or an XSS vulnerability anywhere on your site — can silently read your customers' session cookies and hand them to an attacker, who then logs in as that customer and takes over their account. Without Secure, the cookie can leak over unencrypted connections. Without SameSite, attackers can craft malicious pages that silently submit requests to your store as a logged-in customer (CSRF). Together, insecure cookies are one of the most common ways ecommerce accounts get hijacked, leading to fraudulent orders, leaked personal data, and regulatory liability under laws like GDPR and PCI-DSS. OWASP ranks this entire class of flaws as A07:2021 — Identification and Authentication Failures.

See the complete Insecure cookie guide for every platform and the full background.