For MSPs and Web Agencies
Cookie security checker
Session cookies without the right flags can be sent over unencrypted connections or read by injected scripts.
What is checked
- Secure: the cookie is only sent over HTTPS.
- HttpOnly: scripts in the page cannot read the cookie.
- SameSite: the cookie is not sent on most cross-site requests.
Where the fix belongs
Cookie flags are set by the application or the web server. Examples cover Nginx, Apache, IIS and PHP session settings; CDN rules are not a reliable place to fix them.
Frequently asked questions
Which cookies are checked?
Cookies the website sets on the publicly accessible pages that the scan requests. Cookies set only after sign-in are not visible to a passive scan.