Your antivirus just finished a scan and the result reads something like "7 tracking cookies found, click to remove." It sounds like you've been hacked. You haven't. Tracking cookies are small text...
If someone told you your site needs a cookie policy, you've probably gone looking for a cookie policy template and found ten versions of the same document: dense paragraphs with an empty bracket...
You installed a gdpr cookies popup, maybe a full gdpr cookies banner with toggles for every tracker category, because a plugin nagged you into it or a client asked "are we covered?" and you didn't...
You just installed a consent plugin. Maybe CookieYes, maybe Complianz, maybe something your theme bundled in. The default banner is sitting on your homepage right now, and you're staring at it...
If you have ever stared at a cookie audit and seen a row flagged samesite_default or samesite_none_insecure, you already know the samesite cookie attribute matters more than its three-word name...
You ran a scan on your own site, or someone else ran it for you, and the report came back with a line reading missing_httponly next to your session cookie. Maybe missing_secure sits right below...