Are my website cookies set securely?

Updated 2026-10-17

Short answer: cookies that carry logins or sessions should be marked Secure (sent only over HTTPS), HttpOnly (hidden from page scripts) and SameSite (not sent with other sites' requests). Missing flags make sessions easier to steal.

How to check it yourself

  1. Open your site, then developer tools, then Application (or Storage), then Cookies.
  2. For each cookie, check the Secure, HttpOnly and SameSite columns.
  3. Login and session cookies should have all three.
  4. Set the flags in your app or framework's session settings.

Why it matters

Login and session cookies are the keys to a visitor's account. Cookies sent without the right flags can be read by scripts on the page, sent over plain HTTP, or sent along with requests from other sites, which is how session hijacking and some forged requests work.

Common causes

  • The app or framework's defaults don't set Secure, HttpOnly or SameSite.
  • A plugin or third-party script sets its own cookies without them.
  • The site moved to HTTPS but cookie settings weren't updated.
  • Custom code sets cookies without specifying the flags.

What Preventionlabs shows

Every report's page basics check looks at the cookies your homepage sets and their security flags, alongside page language, link previews, structured data and other upkeep checks.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers