Check your own site

Runs these 3 checks and the other 184, free, in about 45 seconds.

What a passing site looks like

Secure flag on cookies: passeswarning · −2.5 ptseffort S
HttpOnly flag on cookies: passeswarning · −2 ptseffort S
SameSite attribute on cookies: passeswarning · −1.5 ptseffort S

Why it matters. Without Secure, the browser also sends the cookie over plain http://, where anyone on the network can copy it and take over the session.

How to fix it.

Add the Secure attribute to every Set-Cookie header (PHP: session.cookie_secure = 1; Express: cookie: { secure: true }).

Why it matters. Without HttpOnly, any script on the page, including an injected one, can read the cookie and send the session somewhere else.

How to fix it.

Add HttpOnly to every cookie that JavaScript does not need to read; session cookies first.

Why it matters. Without SameSite, the browser attaches the cookie to requests that other sites trigger, which is how cross-site request forgery works. Browsers apply different defaults, so say it explicitly.

How to fix it.

Add SameSite=Lax (or Strict) to every cookie.
Use SameSite=None together with Secure only for cookies a third-party embed genuinely needs.

Check your own site

What a passing site looks like

1. Secure flag on cookies

2. HttpOnly flag on cookies

3. SameSite attribute on cookies