webzod
account

Add Secure to SameSite=None cookies on WordPress

headers.cookies.samesite_none_insecure · effort: minutes

Why it matters

Browsers reject a cookie marked SameSite=None unless it also has Secure, so this cookie is silently dropped and whatever depends on it, such as an embedded widget or a login, fails. Add Secure, or use SameSite=Lax if the cookie is not needed in cross-site requests.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Stage 1: identify the plugin that sets the cookie and set WordPress Address and Site Address to https://.
  2. Stage 2: update the plugin or ask its developer to add Secure; for PHP sessions set session.cookie_secure = 1 in php.ini. Test the flow that uses the cookie.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.