What is a Cookie Security Checker?
Three attributes decide whether cookies are stealable: Secure (HTTPS only), HttpOnly (invisible to JavaScript), SameSite (cross-site request behavior). Session cookies missing them are the classic account-takeover path.
This checker fetches the URL and audits every cookie in the response, attribute by attribute.
How to use the Cookie Security Checker
- Enter a URL that sets cookies (a login or app page, not always the homepage).
- Read each cookie’s flags.
- Fix the flagged attributes where the cookie is set.
Frequently asked questions
The tool says no cookies were set — why?
Many sites set cookies only after consent, login or on app routes. Test the page that actually starts a session.
Which attribute matters most?
HttpOnly for session cookies — it makes XSS unable to read them. Secure is table stakes on any HTTPS site.
What SameSite value should I use?
Lax is the sane default. Strict for high-security actions; None only for legitimate cross-site embedding, and it requires Secure.
What is the __Host- prefix?
A cookie named __Host-session enforces Secure + no Domain + Path=/ at the browser level — a nice hardening step.