---
title: "Cookie security check — Lemwatch Help"
description: "Inspects Set-Cookie headers for Secure, HttpOnly, and SameSite flags — the three attributes that stop session hijacking in modern browsers."
canonical: "https://lemwatch.com/help/cookie-security-check"
source: "https://lemwatch.com"
---

# Cookie security check

> Inspects Set-Cookie headers for Secure, HttpOnly, and SameSite flags — the three attributes that stop session hijacking in modern browsers.

## Quick answer

 Every Set-Cookie on your homepage and login page is checked for Secure, HttpOnly, and SameSite=Lax or Strict.

## What it checks

- Secure flag (HTTPS-only)

- HttpOnly flag (blocks document.cookie access)

- SameSite=Lax or Strict

- Cookie prefixes (__Secure-, __Host-) bonus

## Where to find it in Lemwatch

 **Site details → Security → Cookies.**

## How to fix

- Update your session cookie config: add Secure + HttpOnly + SameSite=Lax.

- For strictly first-party auth, prefer SameSite=Strict.

- Use the __Host- prefix for session cookies bound to the origin.

- Re-run the check.

## FAQ

### Will SameSite=Strict break OAuth?

 It can — SameSite=Lax is safer for redirect-based auth.

### What about tracking cookies?

 Same flags apply — Google, Segment, etc. usually get this right.

## Related

- Security headers

- X-Frame-Options check

- HSTS header check


## Related

- [Help centre](https://lemwatch.com/help)
- [Security Headers Explained](https://lemwatch.com/help/security-headers)
- [X-Frame-Options / frame-ancestors check](https://lemwatch.com/help/x-frame-options-check)
- [HSTS header check](https://lemwatch.com/help/hsts-header-check)
- [TLS version & cipher check](https://lemwatch.com/help/tls-version-check)
- [Certificate chain check](https://lemwatch.com/help/certificate-chain-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Core Web Vitals Explained](https://lemwatch.com/help/core-web-vitals)