Security & SEO

    Cookie security check

    Inspects Set-Cookie headers for Secure, HttpOnly, and SameSite flags — the three attributes that stop session hijacking in modern browsers.

    Updated 2026-07-10
    1 min read
    cookies
    session
    security

    Quick answer#

    Every Set-Cookie on your homepage and login page is checked for Secure, HttpOnly, and SameSite=Lax or Strict.

    What it checks#

  1. Secure flag (HTTPS-only)
  2. HttpOnly flag (blocks document.cookie access)
  3. SameSite=Lax or Strict
  4. Cookie prefixes (__Secure-, __Host-) bonus

    5. Where to find it in Lemwatch#

    Site details → Security → Cookies.

    How to fix#

  5. Update your session cookie config: add Secure + HttpOnly + SameSite=Lax.
  6. For strictly first-party auth, prefer SameSite=Strict.
  7. Use the __Host- prefix for session cookies bound to the origin.
  8. Re-run the check.

    9. FAQ#

    Will SameSite=Strict break OAuth?#

    It can — SameSite=Lax is safer for redirect-based auth.

    What about tracking cookies?#

    Same flags apply — Google, Segment, etc. usually get this right.

    Related#

  9. Security headers
  10. X-Frame-Options check
  11. HSTS header check
    12. Was this article helpful?

    Previous

    X-Frame-Options / frame-ancestors check

    Next

    TLS version & cipher check

    Related Articles

    Security Headers Explained

    What security headers are, why they matter, and how to fix them.

    X-Frame-Options / frame-ancestors check

    Confirms clickjacking protection is enabled via X-Frame-Options or the modern CSP frame-ancestors directive.

    HSTS header check

    Verifies Strict-Transport-Security is present, has max-age ≥1 year, and includes subdomains — the single biggest SSL grade lift.

    How to use the free security header checker

    Grade any site's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) instantly.

    Back to Help Center