Cookies

What we look at

• Secure flag. Every cookie set over https:// is marked to travel only over https://.
• HttpOnly flag. Login and session cookies are kept out of reach of the page's scripts. A session cookie we recognise without it is a Low problem; other cookies without it only earn a Note.
• SameSite. Whether cookies say when they may be sent from other websites. Many browsers already pick a sensible default. Never changes your score.

If your home page doesn't set any cookies, this whole area shows Doesn't apply, as in our sample.

Why it matters

Cookies are how a website remembers things, like who's logged in or what's in a cart.

A cookie without the Secure flag can be sent over plain http://, where someone on the same network, like café Wi-Fi, could read it. One without HttpOnly can be read by any script on the page.

In our sample report

Here's this part of our sample report for a demo website. example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.

Who fixes it

In your report, anything to fix in this area goes to:

• Your web host or website developer.

What we can't see from outside

We only see cookies your server sends with your home page. Cookies set by scripts on the page, or after someone logs in, adds to a cart or answers a cookie banner, don't show up. We never keep a cookie's value. We recognise a session cookie by its name, so that part is our best guess.