Cookie is missing the Secure flag

What does this mean?

At least one cookie your site sets doesn't have the Secure attribute, which means a browser is technically allowed to send it over a plain, unencrypted HTTP connection — not just HTTPS. This can happen if a visitor follows an old bookmark, types a URL without https://, or connects through certain captive portals (hotel/airport wifi login pages) that intercept the first request. Whoever can see that unencrypted traffic (anyone on the same public wifi, a compromised router, an ISP) can read the cookie in plain text.

What are the potential impacts?

• If a cookie is ever sent over an unencrypted connection, anyone positioned to see that traffic (shared wifi, a compromised network device) can read it in plain text.
• A stolen session cookie can often be used to impersonate the logged-in visitor directly, without needing their password at all.
• This is a real risk even on a site that redirects to HTTPS by default, since the very first request before that redirect happens can still occur over plain HTTP.