Cookie missing Secure flag: what it is, why it matters, and how to fix it
One or more cookies are set without the Secure flag, meaning they can be transmitted over unencrypted HTTP connections.
Where this fits: security in SEO
Why cookie missing secure flag hurts your rankings
Without the Secure flag, cookies (including session tokens) can be intercepted by attackers via man-in-the-middle attacks on unencrypted HTTP connections. This is especially dangerous on public Wi-Fi networks where traffic sniffing is trivial.
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it.
How to fix it
Add the Secure attribute to all cookies, especially session cookies and any cookies containing sensitive data. Ensure your site is served exclusively over HTTPS.
Set-Cookie: sessionId=abc123; Secure; HttpOnly; SameSite=StrictFrequently asked questions
What does "Cookie missing Secure flag" mean?
One or more cookies are set without the Secure flag, meaning they can be transmitted over unencrypted HTTP connections.
Why does cookie missing secure flag matter for SEO?
Without the Secure flag, cookies (including session tokens) can be intercepted by attackers via man-in-the-middle attacks on unencrypted HTTP connections. This is especially dangerous on public Wi-Fi networks where traffic sniffing is trivial.
How do I fix cookie missing secure flag?
Add the Secure attribute to all cookies, especially session cookies and any cookies containing sensitive data. Ensure your site is served exclusively over HTTPS.
How serious is this issue?
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects cookie missing secure flag on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by cookie missing secure flag, and hands you a ready-made fix task.
Check my site free