The Secure flag on a cookie tells the browser to only ever send that cookie over an encrypted HTTPS connection, never over unencrypted HTTP. Other audit tools often report this finding as "cookie without the Secure flag".
Why this matters
Without this flag, if a user's connection is briefly downgraded to HTTP (a known attack technique), their cookie - which may contain a login session - can be intercepted by an attacker on the same network.
How to fix it
Set the Secure attribute on all cookies, especially those used for login sessions. This is typically a one-line change in your server or application framework configuration.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.