How to fix insecure cookie on WooCommerce

Steps for WooCommerce

1. Install the 'Headers & Cookies Security' plugin (e.g. 'WP Headers and Cookies' or 'Sucuri Security') to apply secure cookie flags globally without editing code.
2. Alternatively, add the following to your theme's functions.php or a custom plugin (see code snippet): use session_set_cookie_params() before session_start() with httponly=true, secure=true, samesite=Strict.
3. For the WordPress session cookie (wordpress_logged_in_*, wordpress_sec_*), add a filter in functions.php using add_filter('auth_cookie_expiration', ...) — but more directly, add ini_set and session_set_cookie_params as shown in the code snippet.
4. In your wp-config.php ensure FORCE_SSL_ADMIN is set to true: define('FORCE_SSL_ADMIN', true);
5. Go to WP Admin → Settings → General and ensure both WordPress Address and Site Address use https://.
6. Verify flags in browser DevTools → Application → Cookies.

What is insecure cookie?

Every cookie your store sets can carry optional security flags that tell the browser how to protect it. The three most important are: *HttpOnly* (JavaScript on the page cannot read the cookie — so a malicious script injected into your site cannot steal it), *Secure* (the cookie is only ever sent over HTTPS, never plain HTTP), and *SameSite* (the cookie is not sent along with cross-site requests, blocking a class of attack called Cross-Site Request Forgery, or CSRF). A cookie missing any of these flags is being sent to your customers' browsers without those protections in place.

Without HttpOnly, a single piece of injected JavaScript — from a compromised ad, a third-party widget, or an XSS vulnerability anywhere on your site — can silently read your customers' session cookies and hand them to an attacker, who then logs in as that customer and takes over their account. Without Secure, the cookie can leak over unencrypted connections. Without SameSite, attackers can craft malicious pages that silently submit requests to your store as a logged-in customer (CSRF). Together, insecure cookies are one of the most common ways ecommerce accounts get hijacked, leading to fraudulent orders, leaked personal data, and regulatory liability under laws like GDPR and PCI-DSS. OWASP ranks this entire class of flaws as A07:2021 — Identification and Authentication Failures.

See the complete Insecure cookie guide for every platform and the full background.