How do I check if my website's cookies are secure?

Enter your URL in the Cookie Security Checker to audit each cookie's Secure, HttpOnly, and SameSite flags.

What does the Secure cookie flag do?

The Secure flag tells browsers to send the cookie only over HTTPS connections, preventing it from leaking over unencrypted HTTP.

What does HttpOnly protect against?

HttpOnly blocks JavaScript from reading the cookie, which limits the damage of cross-site scripting (XSS) attacks that try to steal session tokens.

What SameSite value should I use?

SameSite=Lax is a good default for most sites; use Strict for sensitive actions and None (with Secure) only when the cookie must be sent in third-party contexts, such as embedded widgets.

WEBSITE SECURITY TOOLS · FREE ONLINE TOOL

Cookie Security Checker

Audit Set-Cookie flags: Secure, HttpOnly and SameSite on every cookieCookies carry session tokens, the keys to logged-in accounts, and a single missing flag can let an attacker steal one. Enter a URL to see every cookie your site sets with its security flags laid bare.

✓ Free to use✓ No sign-up✓ Ready in your browser

// COOKIE SECURITY CHECKER · GET STARTED

Use Cookie Security Checker

Audit Set-Cookie flags: Secure, HttpOnly and SameSite on every cookie

// COOKIE SECURITY CHECKER · AT A GLANCE

Cookie Security Checker: what to know first.

Audit Set-Cookie flags: Secure, HttpOnly and SameSite on every cookie

01
Cookies carry the keys to user sessions, yet their security flags are set once and forgotten. A missing Secure flag lets session cookies leak over HTTP, a missing HttpOnly flag hands them to any XSS payload, and a missing SameSite attribute leaves the door open to CSRF. The Cookie Security Checker reads every Set-Cookie header your server sends and audits each flag individually, with special attention to cookies that look like sessions or auth tokens.
02
Each cookie gets its own verdict with plain-language explanations, so developers and site owners alike can see exactly which flag to add where. The checks follow current browser behavior, including the rule that SameSite=None is rejected without Secure.

// COOKIE SECURITY CHECKER · HOW IT WORKS

How to use the Cookie Security Checker

Enter URL

Enter the website URL whose cookies you want to audit (e.g. https://example.com).

Fetch cookies

Click "Check Cookies" and wait while the Set-Cookie headers are fetched.

Review flags

Review each cookie flag verdict and apply the recommended fixes.

// COOKIE SECURITY CHECKER · ABOUT THIS TOOL

About the Cookie Security Checker

Cookies carry the keys to user sessions, yet their security flags are set once and forgotten. The Cookie Security Checker reads every Set-Cookie header your server sends and audits each flag individually.

Each cookie gets its own verdict with plain-language explanations, so you can see exactly which flag to add where.

Where it helps most

The moments exposed cookies get found.

Pre-launch reviews

Run it before launch as part of a pre-release security review, when fixes are cheapest.

After login changes

Re-check after any change to login, sessions, or third-party integrations, since new cookies creep in silently.

Compliance checks

Demonstrate that session management follows basic hardening practice with an evidence-backed report.

Third-party audits

Know exactly which cookies your site depends on as browsers phase third-party cookies out.

What gets flagged

The findings that matter most.

Missing Secure flag

Session cookies sent over unencrypted connections can be stolen; Secure restricts them to HTTPS only.

Missing HttpOnly

Without it, any injected JavaScript can read the cookie through document.cookie and steal the session.

Weak SameSite settings

Lax blocks most cross-site request forgery; None is only for cookies that must travel cross-site, with Secure alongside.

Cookie Security Checker: built for trust

It takes seconds and needs no signup, and often surfaces the low-effort, high-impact fix that makes a security audit worthwhile.

// COOKIE SECURITY CHECKER · COMMON QUESTIONS

Cookie Security Checker FAQs

What makes a cookie secure?

Three flags do most of the work: Secure restricts it to HTTPS connections, HttpOnly hides it from JavaScript, and SameSite controls when browsers send it cross-site. This checker verifies all three on every cookie your site sets.

What does the HttpOnly flag do?

Which SameSite setting should I use?

Why is my Secure cookie not being set?

Do embedded widgets need SameSite=None; Secure?

tools-guide

Free Password Generator: Create Strong, Secure Passwords in Seconds

Generate strong, unbreakable passwords in one click with ZaxisMedia's free Password Generator. Customizable length, symbols & one-click copy. No signup needed.

Read article →