Cookie Security Scanner
Analyze a website's cookies for missing Secure, HttpOnly, and SameSite protections.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
Every cookie a site sets should carry three flags: Secure (only sent over HTTPS), HttpOnly (invisible to JavaScript, so it can't be stolen via XSS), and SameSite (limits cross-site requests). This tool checks a site's cookies for all three.
A cookie missing these flags is one of the most common — and most overlooked — ways session tokens get hijacked, since the fix is usually a one-line server config change once you know it's missing.
Frequently asked questions
Which missing cookie flag is the most urgent to fix?
HttpOnly is usually top priority for session cookies — it blocks JavaScript from reading the cookie, which closes off the most common real-world attack path: an XSS vulnerability stealing a session.
Does this tool check first-party cookies only, or third-party too?
It scans whatever cookies the site sets when the page loads, which typically includes both — useful for spotting third-party trackers alongside your own session cookies.
Related tools