add_action( 'send_headers', function() { // Reescribe cada Set-Cookie para añadir HttpOnly, Secure y SameSite=Strict if ( headers_sent() ) { return; } header_remove( 'Set-Cookie' ); foreach ( array_unique( headers_list() ) as $header ) { if ( stripos( $header, 'Set-Cookie:' ) === 0 ) { list( , $cookie ) = explode( ':', $header, 2 ); $cookie = trim( $cookie ); // Si ya tiene SameSite no lo duplicamos if ( stripos( $cookie, 'samesite' ) === false ) { $cookie .= '; Secure; HttpOnly; SameSite=Strict'; } header( 'Set-Cookie: ' . $cookie, false ); } } }, 1 );