What This Number Tells Us
Across 165,173 scans of 93,811 unique small-business WordPress sites, only 37.1% fully passed the cookie security check. The remaining 62.9% left at least one recommended browser defense off their cookies—most often, the "Secure," "SameSite," or "HttpOnly" attributes.
This finding matters because misconfigured cookies can make it easier for attackers to exploit authentication sessions, steal user information, or trick browsers into leaking logged-in access. While cookies themselves rarely "leak" data directly, missing key flags removes several layers of defense against common attacks like session hijacking and cross-site request forgery.
From a business standpoint, even if no breach has occurred, weak cookie settings erode user trust and bring many sites out of alignment with current security expectations—and, in some sectors, regulatory requirements.
Cookie configuration is rarely the root cause of a full compromise. But with automated attack tools scanning for these gaps, each missing flag is an avoidable target.
What Was Measured
Our scans tested whether session cookies set by WordPress and its plugins included all three recommended security flags:
- Secure: Cookie is only sent over HTTPS, protecting data in transit.
- HttpOnly: Cookie can’t be accessed via browser JavaScript, blocking most XSS-based theft.
- SameSite: Restricts cross-site cookie usage, a key defense against CSRF (cross-site request forgery).
A "Good" score required that all session cookies met these standards, not just one or two flags set.
Below, the full results across all security grades in the past 90 days:
| Grade | # Sites | % of Sites |
|---|---|---|
| A+ | 188 | 0.1% |
| A | 345 | 0.2% |
| B+ | 1,839 | 1.1% |
| B | 1,070 | 0.6% |
| C+ | 19,617 | 11.9% |
| C | 10,630 | 6.4% |
| D | 46,475 | 28.1% |
| F | 70,351 | 42.6% |
And the specific "Good" pass rates from these same scans:
| Security Check | % Rated Good |
|---|---|
| Cookie Security (all critical flags present) | 37.1% |
| SSL/TLS Configuration (full-strength) | 6.9% |
| Security Headers (all required) | 0.4% |
| Content Security Policy | 0.0% |
| Mixed Content | 74.7% |
| Server Banner (no version leak) | 1.4% |
| TLS Protocol Security | 92.8% |
Who Is Most at Risk
Sites handling logins, payments, or private user accounts without robust cookie flags are at higher risk of attack escalation. This includes e-commerce stores, membership sites, and agency-managed client portals—sites where authenticated sessions carry real business value.
Smaller businesses often rely on standard WordPress or WooCommerce plugins, assuming out-of-the-box security is enough. In practice, defaults and plugin interactions leave many cookies partly unprotected.
Any site processing personal or payment information must be especially careful, as missing cookie protections may also bring compliance risk in regulated industries.
What You Can Do
Improving cookie security is high-yield: the technical changes are straightforward, and many can be completed without deep development skills.
- Audit Session Cookie Flags: Use a website security scan to check your site's current cookies. Look for missing Secure, HttpOnly, and SameSite attributes. (Time: <5 minutes)
- Enforce HTTPS Sitewide: Ensure all cookies use HTTPS by default. Update WordPress and hosting settings as needed. (Time: 15-30 minutes, may require certificate review)
- Update to Modern Plugins: Older plugins may set cookies without proper flags. Review plugin changelogs for recent security updates. (Time: 30-60 minutes for audit and updates)
- Apply WordPress Hardening Plugins: Select hardening plugins that add or enforce secure cookie flags. Some security add-ons offer automatic cookie flagging. (Time: 10-20 minutes)
Final Thoughts
62.9% of small-business WordPress sites scanned in the last 90 days did not fully pass the cookie security check. This is not just a technical footnote—it’s an avoidable, fixable gap that weakens session protection across a major slice of the web.
Checking cookie flags is one of the fastest ways to reduce your site's risk from automated exploits. Take five minutes to scan your site for cookie security gaps and close the most common cracks before attackers test them for you.
FAQ
Are my cookies the same as my customers’ cookies?
In most WordPress setups, user sessions (like customer accounts or admin dashboards) are both tracked by cookies set by your site. Protecting these cookies shields both you and your users.
Is HTTPS alone enough to secure cookies?
No. HTTPS encrypts traffic, but Secure and HttpOnly cookie flags provide additional layers. Setting only one flag does not protect against all relevant attacks.
I run WooCommerce. Do I need to care?
Absolutely. Any site with logins, carts, or payments shares these cookie security risks. It's not just big brands—attackers scan broadly for weaknesses.
If I haven’t seen signs of targeting, am I safe?
Not necessarily. Most attacks start with automated scans—prevent gaps before they’re tested.