Website · Fix guide
Cookie security needs review
One or more initial-response cookies omit Secure or SameSite protection.
What does this test measure?
One or more initial-response cookies omit Secure or SameSite protection.
What to do next
- Add Secure to cookies that should only travel over HTTPS.
- Choose an appropriate SameSite value.
- Add HttpOnly to session cookies that JavaScript does not need.
How to verify the fix
Inspect cookies after sign-in and across important application flows.
When this result may be wrong
This check sees the initial response only; consent and authenticated cookies can differ.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.