HTTPS Checker

Security Tool

Secure Cookie Flags: Secure, HttpOnly, and SameSite

When a site sets a cookie, attributes on the Set-Cookie header decide whether scripts can read it, whether it is sent only on HTTPS, and whether it is included on cross-site requests. Our checker surfaces these flags for cookies seen on the final HTTPS response (informational — they do not change the SSL letter grade).

Key takeaways

  • Secure — cookie only sent over HTTPS. Required for any session on an HTTPS site.
  • HttpOnly — not readable from JavaScript; reduces impact of XSS on session cookies.
  • SameSite — Lax or Strict for most apps; None needs Secure and is for deliberate cross-site use.

Example header

Set-Cookie: session=…; Path=/; HttpOnly; Secure; SameSite=Lax

Where to set them

  • Application frameworks — session middleware options (Express cookie, Rails cookies.signed, Django SESSION_COOKIE_*, etc.).
  • CDN / edge — some products can inject or rewrite Set-Cookie; prefer fixing at the app so behaviour is consistent.
  • WordPress — prefer plugins / server config that force Secure on auth cookies once the site is fully HTTPS (redirect first).

How we report it

On a successful check, expand Cookie security in the result card. Cookies missing Secure or HttpOnly are highlighted. Re-test after deploy with the free HTTPS checker.

Check cookie flags