Cookies should be secured by using the secure flag to ensure they are sent over HTTPS only, setting them to HTTP-only to prevent access from JavaScript, and defining a strict expiration period.