Security headers check

Cookies are set with safe flags

Cookies set by the response use Secure, HttpOnly where appropriate, and SameSite.

low severitysec.cookie-flags

Run this check on your site

Runs just this check in quick mode. The report opens with the evidence and the fix.

Why it matters

A cookie without Secure travels over plain http, one without HttpOnly is readable by scripts, and one without SameSite is sent with cross site requests.

How to fix it

Set Secure, HttpOnly and SameSite=Lax or Strict on every cookie that needs it.

The details

Category: Security headers
Severity of a failure: low
Confidence: high
Needs a browser: No
Check id: sec.cookie-flags

References

MDN: Set-Cookie

Free tools that run this check

Security Headers CheckerSecurity headers tell browsers to stay on HTTPS, refuse to be framed, stop guessing content types and limit what scripts may do. Check which ones your site sends and how they are set.