Cookie Security Checker
Check every cookie a site sets for the flags that matter.
Three attributes carry almost all of a cookie's security. Secure keeps it off unencrypted connections. HttpOnly keeps it out of reach of JavaScript, which is what stops a single cross-site scripting flaw from turning into full session theft. SameSite governs whether the browser attaches it to requests originating from other sites, which is the main defence against cross-site request forgery.
The cookie name prefixes are worth knowing because browsers enforce them. A cookie named with the __Host- prefix must be Secure, must have no Domain attribute and must use Path=/; if it does not, the browser rejects the cookie outright rather than storing a weaker version. That makes a prefix violation a bug you can watch break your login, not a theoretical hardening item.
SameSite=None deserves particular care. It is required for genuine third-party contexts — an embedded widget, a cross-domain single sign-on flow — but it removes SameSite as a CSRF defence, and browsers reject it entirely unless Secure is also set. A cookie sent with SameSite=None over plain HTTP simply does not exist as far as the browser is concerned.
What this tool does
Per-cookie verdict
Secure, HttpOnly and SameSite assessed for each cookie individually, because one weak session cookie undoes a page of good ones.
Severity that depends on the cookie
A missing HttpOnly on a theme preference is a note; on something named session or auth it is critical. The name is used to tell them apart.
Prefix rules enforced
__Host- and __Secure- carry browser-enforced requirements. A cookie that breaks them is dropped entirely — a functional bug, not just a hardening gap.
Values never shown
Only the length of each cookie value is reported. The tool has no reason to display a session token and does not.
Frequently asked questions
What do Secure, HttpOnly and SameSite actually do?
Secure stops the browser sending the cookie over unencrypted HTTP. HttpOnly hides it from document.cookie, so page JavaScript cannot read it. SameSite controls whether the cookie is attached to requests that started on another site, which is what makes cross-site request forgery hard.
Why does HttpOnly matter so much for session cookies?
Because it decides how bad a cross-site scripting bug is. Without HttpOnly, any injected script can read the session cookie and send it elsewhere, turning any XSS anywhere on the site into account takeover. With it, the attacker can still act as the user in that page, but cannot walk away with the session.
Should I use SameSite=Strict or Lax?
Lax is the sensible default for a session cookie: it blocks the cross-site request shapes that matter while still sending the cookie when someone follows a link to your site, so people arriving from search or email stay logged in. Strict blocks even that, which is right for high-value actions and surprising for ordinary login.
What is the __Host- prefix for?
It lets a cookie make a promise the browser enforces: Secure, no Domain attribute, and Path=/. Because Domain is forbidden, a __Host- cookie cannot be set by a subdomain onto the parent domain, which closes off cookie-fixation attacks from a compromised or attacker-controlled subdomain.
Why did my cookie disappear after I added SameSite=None?
Because SameSite=None without Secure is rejected by every current browser. The cookie is never stored. Add Secure — and note that this means it will not work over plain HTTP at all, including on a local development server unless it is running over HTTPS.
Does this tool see cookies set by JavaScript?
No. It reads Set-Cookie headers from the HTTP response, so it sees what the server sets. Cookies written later by page scripts do not appear, and neither do cookies set on other paths or by third-party embeds. It is a check of your server's configuration, not a full inventory.
Are my cookie values sent anywhere or stored?
The tool fetches the URL you give it from our server and reports the attributes of each cookie plus the length of its value. The values themselves are neither displayed nor retained.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.