Skip to content
Check a domain

Cookie check

Runs in every scan · 4 checks

Check your cookie security flagsSecure, HttpOnly and SameSite.

Make sure the cookies that keep visitors signed in are set safely, with the exact line to fix any that aren't.

  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription

What we check

What we look at.Each with evidence and a fix.

Part of every Quick Scan, alongside the other checks.

  • Secure

    Cookies only travel over HTTPS.

  • HttpOnly

    Page scripts can't read them, unless they need to.

  • SameSite

    A SameSite attribute is set on each cookie.

  • Sign-in cookies first

    Cookies that look like session cookies are ranked higher.

Why it matters

Small settings.A big difference for your visitors.

  • Sessions stay private

    Even on public Wi-Fi.

  • Scripts can't lift them

    HttpOnly keeps sign-in cookies out of reach.

  • Minutes to fix

    Usually one setting in your platform.

What a finding looks like

Plain English.With the evidence behind it.

Open the full sample report

F2 · cookie-flags

Keep the login cookie on HTTPS

Medium Confirmed Minutes

What it means
The session cookie is set without the Secure flag. Adding it keeps the cookie on encrypted connections, so signed-in sessions stay private, even on public Wi-Fi.
Evidence
Set-Cookie: PHPSESSID=…; path=/
              ↑ no Secure, no HttpOnly
Expected
Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax
Fix
Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.

How to fix it

A few clear steps.In the order to take them.

Your report has the exact fix for your site, ready to forward to whoever looks after it.

  1. Find the cookie settings in your platform or framework. Most have a single switch for each flag.

  2. Add Secure and HttpOnly to sign-in and session cookies, and SameSite=Lax (or Strict).

  3. Run another check to confirm the new settings are live.

A well-set session cookie
Set-Cookie: session=…; Path=/; Secure; HttpOnly; SameSite=Lax

Questions

Cookie security questions.

Something else? support@scandefend.com

What do Secure, HttpOnly and SameSite do?

Secure means the cookie is only sent over HTTPS. HttpOnly hides it from JavaScript on the page. SameSite controls whether other sites can make the browser send it along with their requests. Together they keep sign-in cookies private.

Should I use SameSite=Lax or Strict?

Lax suits most sites: the cookie is still sent when someone follows a link to you. Strict is tighter but can sign people out when they arrive from another site.

Do you check cookies set after login?

A Quick Scan reads the cookies your homepage sets. Cookies that only appear after signing in sit outside its scope, and the report says so.

Is this about cookie consent banners?

No. This check is about how cookies are protected, not about consent. Both matter; they're separate jobs.

Keep exploring

Also useful: What we check Sample report Pricing For developers

See what your website shows.Know what to fix first.

See pricing