How to protect a site's cookies/sessions from being hijacked?

Been working on a new site that will use browser's cookies to log in users. In layman's terms give me some tips on how to protect site's cookies/sessions from being hijacked. What are some common practices?