Security Headers Checker / Headers
Cookie security flags: Secure, HttpOnly, SameSite, prefixes
A session cookie is a key to the account. Secure keeps it off plain HTTP, HttpOnly keeps scripts (including injected ones) from reading it, SameSite stops other sites from sending it with forged requests, and __Host- pins it to the exact host over HTTPS.
What to do
Session cookies: Secure; HttpOnly; SameSite=Lax; Path=/, and no Domain attribute (or the __Host- prefix). Set the flags where the cookie is created; our fixes cover 32 platforms.
How our grade counts it
- Coverage, up to 15 points: share of cookies with every applicable flag (Secure; HttpOnly for session cookies; SameSite; valid prefixes); N/A when no cookie is set
- Effectiveness, minus 30: Cookie exposures (session cookie without Secure 20, without HttpOnly 15, SameSite=None without Secure 10; capped at 30). Other flag gaps count through the coverage share only
Common mistakes
- A Domain attribute that shares the session cookie with every subdomain.
- SameSite=None without Secure: browsers reject the cookie.
- SameSite=Strict on a login cookie: visitors arriving from a link look logged out.
Check your site
The checker reads Set-Cookie flags the way a browser applies it, alongside every other security header.
Open the Security Headers Checker