Are your cookies protected?
Whether the cookies your homepage sets carry the Secure, HttpOnly and SameSite flags.
Why it matters
Session cookies are the keys to your users' accounts. Secure keeps them off plain HTTP, HttpOnly keeps them away from scripts on the page, and SameSite stops them being sent along with requests started by other sites. A cookie without them is easier to steal or misuse.
How a survey checks it
Passive check: part of every free survey.
We read the Set-Cookie headers your homepage sends. We never store a cookie's value. Analytics and consent cookies are left out, and cookies that look like sessions count for more than others.
How to fix it
- Mark every cookie Secure once your site is on HTTPS.
- Mark session and sign-in cookies HttpOnly so scripts cannot read them.
- Set SameSite to Lax for most cookies, or Strict where it does not break sign-in flows.
Prefer us to do it? Ask for a fix quote
Common questions
My CSRF cookie is not HttpOnly. Is that a problem?
No. Some frameworks deliberately let scripts read the CSRF token cookie so they can send it back. We do not flag that.
Where are these flags set?
Usually in your framework's session or cookie settings, or in the auth library that creates the cookie.