Session cookie is missing the Secure flag

What it is

Your site sets a cookie (typically PHPSESSID, laravel_session, _ga, etc.) without the Secure flag. The browser will send it even over unencrypted HTTP whenever it gets the chance.

Why it’s a problem

An attacker with access to the network between you and the user (a coffee-shop Wi-Fi, a compromised router, an ISP in a country with active surveillance) can:

Sniff the cookie and hijack the session.
Force the browser to visit http://example.cz via an unrelated HTTP link and capture the cookie there.

Even if you have HTTPS everywhere, without Secure it’s enough for the user to have any HTTP site on the same domain open in another tab, and the cookie leaks.

How to fix it

The goal is to set all three security flags: Secure, HttpOnly and SameSite.

Session cookies (most important)

PHP:

# php.ini (or .htaccess with php_value)
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

Node.js (express-session):

app.use(session({
    secret: process.env.SESSION_SECRET,
    cookie: {
        secure: true,
        httpOnly: true,
        sameSite: 'lax',
        maxAge: 1000 * 60 * 60 * 24,
    }
}));

Laravel (config/session.php):

'secure' => true,
'http_only' => true,
'same_site' => 'lax',

WordPress: WordPress handles sessions via cookies, but has no auto-adding of the Secure flag. Use the Cookies Flags plugin or add it manually:

// wp-config.php
define('COOKIE_DOMAIN', '.example.cz');
@ini_set('session.cookie_secure', 1);

// functions.php
add_action('init', function () {
    if (!is_ssl()) return;
    foreach ($_COOKIE as $name => $val) {
        setcookie($name, $val, [
            'expires'  => 0,
            'path'     => '/',
            'secure'   => true,
            'httponly' => true,
            'samesite' => 'Lax',
        ]);
    }
});

Third-party cookies (analytics, retargeting)

Cookies set by third parties (Google Analytics, _fbp, etc.) are not under your control. At the very least, make sure you set them on an https:// page — the third party will then add the Secure flag by default.

Verification

DevTools → Application → Cookies. Look at the Secure column — it should be true for every cookie that carries any authentication.