title: How can I resolve a cross-site Google Analytics cookie `SameSite=None` warning in Chrome on Apache 2.4 and PHP 7.1?
body: <p>My client's website is getting these SameSite cookie warnings in Chrome.  I've searched all over and I can't get the warnings to go away.   The cookies are due to Google Ad Conversion Tracking on a Wordpress Site. The site is on a Apache/2.4.7 (Ubuntu) hosted by DreamHost running PHP 7.1 for compatibility reasons.  To my .htaccess file, I've tried adding:</p>
  <pre><code>Header always edit Set-Cookie (.*) &quot;$1; SameSite=None&quot;
  </code></pre>
  <p>and I tried</p>
  <pre><code>Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
  </code></pre>
  <p>...and I tried</p>
  <pre><code>Header always edit Set-Cookie (.*) &quot;$1; SameSite=None;Secure&quot;
  </code></pre>
  <p>as well as many other combinations including SameSite=Lax</p>
  <p>One guide recommends for PHP 7.2 and below:</p>
  <pre><code>header('Set-Cookie: cross-site-cookie=bar; SameSite=None; Secure');
  </code></pre>
  <p>But that gives me a <code>500 Internal Server Erorr</code>.</p>
  <p>Yet I am still getting the following three errors:</p>
  <blockquote>
  <p>A cookie associated with a cross-site resource at  was set without the <code>SameSite</code> attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with <code>SameSite=None</code> and <code>Secure</code>. You can review cookies in developer tools under Application&gt;Storage&gt;Cookies and see more details at  and .</p>
  <p>(index):1 A cookie associated with a resource at <a href="http://doubleclick.net/" rel="noreferrer">http://doubleclick.net/</a> was set with <code>SameSite=None</code> but without <code>Secure</code>. A future release of Chrome will only deliver cookies marked <code>SameSite=None</code> if they are also marked <code>Secure</code>. You can review cookies in developer tools under Application&gt;Storage&gt;Cookies and see more details at <a href="https://www.chromestatus.com/feature/5633521622188032" rel="noreferrer">https://www.chromestatus.com/feature/5633521622188032</a>.</p>
  <p>(index):1 A cookie associated with a resource at <a href="http://google.com/" rel="noreferrer">http://google.com/</a> was set with <code>SameSite=None</code> but without <code>Secure</code>. A future release of Chrome will only deliver cookies marked <code>SameSite=None</code> if they are also marked <code>Secure</code>. You can review cookies in developer tools under Application&gt;Storage&gt;Cookies and see more details at <a href="https://www.chromestatus.com/feature/5633521622188032" rel="noreferrer">https://www.chromestatus.com/feature/5633521622188032</a>.</p>
  </blockquote>
  <p>In my research, there seems to be limited information about the warning, and in the guides that are available, I'm not sure if I must identify the cookie by name or how to fix the cookie/headers at their source.</p>