phpBB HTTPS Setup: Secure Cookies Are Only One Step

phpBB’s Cookie secure setting controls whether its cookie is sent only over a secure connection. It does not install a certificate, enable TLS on the web server or redirect every forum URL to HTTPS.

Make HTTPS work first

Back up the forum database/configuration and preserve a recovery administration route. Install a trusted certificate covering the forum hostname and verify the HTTPS board before changing application settings. Check the actual phpBB version and any reverse proxy or CDN.

Configure phpBB for the HTTPS board

1. In the Administration Control Panel’s General area, review Server configuration and the server/cookie settings for your version.
2. Confirm the intended hostname, script path and protocol. If forced server-URL settings are enabled, review their scheme/port deliberately rather than changing unrelated cookie domains.
3. Once the forum operates on HTTPS, enable Cookie secure and save the setting.
4. Configure the HTTP-to-HTTPS redirect at the appropriate server/proxy layer. A secure-cookie flag is not a redirect rule.

Check sessions and links

Test a new login session, logout, forum navigation, attachments, posting and administrator access. Check extensions and embedded images for insecure requests. If old cookies interfere, investigate the cookie name/domain/path and the vendor’s recovery guidance; do not fix a server certificate error by disabling validation or sending passwords over HTTP.

Keep certificate renewal monitored. The old claim that a cookie toggle enables SSL or establishes search ranking was withdrawn. HTTPS is transport protection, not complete forum security.

References: phpBB HTTPS configuration; phpBB cookie settings. Confirm the applicable release before changing production.

Reviewed October 15, 2026. No live forum configuration or login session was changed.