I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company.
My company recently spent a bunch of money on a security audit by consultants and they found the following issues regarding login/cookie and how they work in Wordpress.
-User session cookies are not secure -session validation is not destroyed and is still active when a user logs out -session cookie includes the username in it
Is there any way do fix these issues?