title: Nginx set_cookie_flag security hardening alternative for Wordpress
body: <p>By setting <code>HttpOnly</code> flag within the relevant Set-cookie directive, it makes certain client-side attacks such as cross-site scripting harder to exploit by preventing trivial capturing of a cookie's value.</p>
  <p>Also, by setting <code>secure</code> flag within the relevant Set-cookie directive, it prevents a cookie from being intercepted by a man in the middle attack by making sure cookies are never transmitted over unencrypted communications.</p>
  <p>I understand that these could be achieved by using the <code>nginx_cookie_flag_module</code> and adding <code>set_cookie_flag HttpOnly secure;</code> in my nginx configuration.</p>
  <p>However according to this <a href="https://www.nginx.com/products/nginx/modules/cookie-flag/" rel="nofollow noreferrer">nginx product page</a>:</p>
  <blockquote>
  <p><strong>Cookie-Flag</strong></p>
  <p>Set the flags “HttpOnly”, “secure” and “SameSite” for cookies in the “Set-Cookie” upstream response headers.</p>
  <p>Support details: Supported by NGINX, Inc. <strong>for active NGINX Plus subscribers</strong>.</p>
  </blockquote>
  <p>So besides subscring to NGINX Plus to get this feature, are there alternative methods to set the HttpOnly and secure flag?</p>
  <p><em>Background - I am running Wordpress 4.9.6 with PHP-FPM-FCGI 7.1.19 behind NGINX 1.10.3 reverse proxy.</em></p>
  <p><strong>TL; DR</strong></p>
  <p><strong>How do I set HttpOnly and secure flag on Set-Cookie reponse header of Wordpress without a NGINX Plus subscription?</strong></p>