Web security

Cookies flagged Secure, HttpOnly and SameSite

Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.

Why it matters

A cookie without Secure can be sent over plain HTTP, where an attacker on the same network can steal it and log in as the user.

How to fix it

Quick fix · under 1 hour

Set the Secure attribute where the application creates cookies.
Reload the web server and re-run the scan to confirm.

PHP (php.ini)

session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

nginx (proxy, 1.19.3+)

proxy_cookie_flags ~ secure httponly samesite=lax;

Express (Node.js)

app.use(session({ cookie: { secure: true, httpOnly: true, sameSite: 'lax' } }))

Test this now, free: Security headers checker - no sign-up.

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free