What this cookie security checker tests
A cookie is a small piece of data a website stores in your browser, and it is often the thing that keeps you logged in. Because a session cookie can stand in for your password, the flags a site attaches to its cookies decide how hard those cookies are to steal or abuse. This checker fetches the live response from the URL you enter, reads the Set-Cookie headers, and shows you each cookie alongside the three flags that matter most.
The first flag is HttpOnly. When a cookie is marked HttpOnly the browser hides it from JavaScript, so a cross-site scripting payload cannot read it through document.cookie and walk away with a logged in session. Every authentication cookie should carry it. A hardened example looks like Set-Cookie: session=abc123; HttpOnly.
The second flag is Secure. It tells the browser to send the cookie only over an encrypted HTTPS connection, which keeps it off plain HTTP where a network attacker could intercept it. On any site served over HTTPS, every cookie should set it, as in Set-Cookie: session=abc123; Secure.
The third flag is SameSite. It controls whether the cookie rides along on requests started by another website. Setting it to Lax or Strict means a malicious page cannot quietly trigger an authenticated request to your site using the victim's cookie, which is the core of a cross site request forgery, or CSRF, attack. A strong combination of all three reads Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax.
If this checker flags a cookie as missing a flag, add the relevant attributes wherever your application sets that cookie, then re-scan to confirm. For a deeper walkthrough of choosing between Lax and Strict, the __Host- prefix, and framework specific settings, read our guide on how to secure cookies.