title: How to secure and validate _fbp cookie
body: <p>I am running a Netsparker scan on my site and it has raised an issue regarding the _fbp (Facebook) cookie - not being Secure and not marked as HttpOnly.</p>
  
  <p>The code that Facebook has supplied which needs to go in the HEAD is:</p>
  
  <pre><code>&lt;script&gt;
  !function (f, b, e, v, n, t, s) {
      if (f.fbq) return; n = f.fbq = function () {
          n.callMethod ?
              n.callMethod.apply(n, arguments) : n.queue.push(arguments)
      }; if (!f._fbq) f._fbq = n;
      n.push = n; n.loaded = !0; n.version = '2.0'; n.queue = []; t = b.createElement(e); t.async = !0;
      t.src = v; s = b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t, s)
  }(window,
      document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');
  fbq('init', 'XXXXXXXXXXXXX'); // Insert your pixel ID here.
  fbq('track', 'PageView');
  &lt;/script&gt;
  
  
  &lt;noscript&gt;
      &lt;img style="width: 1px; height: 1px; display: none"
      src="https://www.facebook.com/tr?id=XXXXXXXXXX&amp;ev=PageView&amp;noscript=1" /&gt;
  &lt;/noscript&gt;
  </code></pre>
  
  <p>I would like this to be Secure and marked as HttpOnly if possible. </p>
  
  <p>Plus, TotalValidator which is validating the site for WCAG2 AA is flagging an issue with the Image in the NoScript tag as Invalid.</p>
  
  <p>Do we have to live with both these issues or is there a way to fix these issues?</p>