Headers Security
critical Severity
Free Check
Set-Cookie Headers (Secure, HttpOnly, SameSite)
Cookie security attributes (Secure, HttpOnly, SameSite) protect session cookies from theft and cross-site attacks.
Why It Matters
Without HttpOnly, malicious XSS scripts can read session cookies. Without Secure, cookies can be transmitted in plaintext HTTP.
How We Check This
We inspect all Set-Cookie response headers to ensure Secure, HttpOnly, and SameSite=Lax|Strict attributes are declared.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
proxy_cookie_flags ~ secure httponly samesite=lax;
Frequently Asked Questions
What is the difference between SameSite=Lax and SameSite=Strict?
Lax permits safe top-level navigations (like following a link), while Strict blocks cookies on all cross-site requests.