COOKIE
WAITINGCookies
Enter a domain above to run this check.
COOKIES
CHECK.
See the cookies the site sets on the first visit and whether they have Secure, HttpOnly and SameSite. Cookie values are never read or stored.
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
What the check verifies
Analyses the cookies set on the first visit and the attributes of each one: Secure, HttpOnly and SameSite. Cookie values are never read or stored.
Why it matters
A session cookie without Secure can leak over HTTP, without HttpOnly it is exposed to scripts and without SameSite it is more exposed to CSRF.
What each result means
- OK
- No cookie on the first visit, or all of them with the expected attributes.
- WARNING
- A cookie without Secure on an HTTPS site, a session cookie without HttpOnly or SameSite=None without Secure.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
Secure on every cookie of an HTTPS site and HttpOnly on session cookies. In PHP: session.cookie_secure = On, session.cookie_httponly = On and session.cookie_samesite = Lax in php.ini.
Set-Cookie: session=…; Path=/; Secure; HttpOnly; SameSite=LaxWould rather have someone else do it? Bit Happens can fix this →
More checks in Website and HTTPS
- Site status
- HTTPS redirect
- HSTS
- Security headers
- Server, CDN and WAF
- robots.txt
- Sitemap
- security.txt
- Title, description and social
- Mixed content and SRI
- Third parties and trackers
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →