Insecure Cookie Scanner
Detects cookies missing the Secure, HttpOnly or SameSite attributes that guard against theft and CSRF.
What it checks
This scanner inspects the cookies your site hands to the browser and checks whether they are missing the Secure, HttpOnly or SameSite attributes. These attributes limit how and when each cookie can be used. It only looks at the protection flags, not the cookie contents.
Why it matters
A session cookie without these attributes can be stolen by malicious scripts or travel unencrypted, letting someone impersonate your users. It also enables CSRF attacks where a third party acts on the user's behalf. In practice this can mean full account takeover.
How to fix it
When creating cookies, set Secure so they only travel over HTTPS, HttpOnly so JavaScript cannot read them, and SameSite (Lax or Strict) to limit cross-site use. Most frameworks and session libraries expose these options in their configuration. Pay special attention to your login or session cookie.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free