What is a Cookie Security Checker?
Three attributes decide whether cookies are stealable: Secure (HTTPS only), HttpOnly (invisible to JavaScript), SameSite (cross-site request behavior). Session cookies missing them are the classic account-takeover path.
This checker fetches the URL and audits every cookie in the response, attribute by attribute.
Frequently asked questions
The tool says no cookies were set: why?
Many sites set cookies only after consent, login or on app routes. Test the page that actually starts a session.
Which attribute matters most?
HttpOnly for session cookies: it makes XSS unable to read them. Secure is table stakes on any HTTPS site.
What SameSite value should I use?
Lax is the sane default. Strict for high-security actions; None only for legitimate cross-site embedding, and it requires Secure.
What is the __Host- prefix?
A cookie named __Host-session enforces Secure + no Domain + Path=/ at the browser level: a nice hardening step.