How to set Secure, HttpOnly and SameSite on cookies
Three cookie attributes stop cookies from leaking over HTTP, being read by scripts or being sent in cross-site requests.
Step by step, with screenshots: HttpOnly cookie, Secure and SameSite: the cookie flags explained →
Check your own site
Runs these 3 checks and the other 190, free, in about 45 seconds.
Or run only this check with the free Cookie scanner (GDPR consent), the free Security headers checker or the free WooCommerce SEO checker.
What it is
Cookie flags are attributes in the Set-Cookie header that limit how the browser handles a cookie. Secure sends it only over HTTPS, HttpOnly hides it from JavaScript, and SameSite controls whether it is sent on requests started by other sites.
Session and login cookies are the keys to your visitors' accounts, so each missing flag opens a way to steal or misuse them: sniffing an HTTP connection, theft by an injected script, or cross-site request forgery. getReport counts the cookies your pages set without each flag. A session cookie is OK with Secure, HttpOnly and SameSite=Lax or Strict; analytics cookies that scripts must read cannot be HttpOnly, but should still be Secure.
What a passing site looks like
- Secure flag on cookies: passeswarning · −2.5 ptseffort S
- HttpOnly flag on cookies: passeswarning · −2 ptseffort S
- SameSite attribute on cookies: passeswarning · −1.5 ptseffort S
Questions people ask
What is an HttpOnly cookie?
It is a cookie set with the HttpOnly attribute, which the browser sends with requests to your server but never exposes to JavaScript through document.cookie. A script injected into your page therefore cannot read it and send it elsewhere. Use HttpOnly for session, login and cart identifiers; your server still reads them normally.
What is a SameSite cookie?
SameSite is a cookie attribute that decides whether the browser sends the cookie when another site triggers a request to yours. Strict never sends it cross-site, Lax sends it only for top-level navigation such as clicking a link, and None always sends it but requires Secure. Chrome and Edge treat cookies without the attribute as Lax, and other browsers differ, so set it explicitly.
What does the HttpOnly flag prevent?
It prevents scripts in the page from reading the cookie, which blocks the most common way cross-site scripting turns into account takeover: stealing the session cookie. It does not stop an injected script from making requests while the visitor is on the page, so it complements, rather than replaces, a Content-Security-Policy and proper escaping of output.
What is the difference between SameSite Lax, Strict and None?
Strict keeps the cookie off every request that starts on another site, even a normal link, so visitors arriving from a search result appear logged out on the first page. Lax, the practical default, sends it when someone follows a link to your site but not with cross-site forms, images or iframes. None sends it everywhere, requires Secure, and is only for cookies that must work inside third-party embeds.