What is Secure and HttpOnly cookies?
The Secure flag keeps a cookie from being sent over unencrypted connections, and HttpOnly stops page scripts from reading it, which protects session cookies from theft.
Why businesses care
A stolen session cookie lets an attacker act as the logged-in user without a password.
Example
Set-Cookie: session=…; Secure; HttpOnly; SameSite=LaxHow to check
Inspect Set-Cookie headers in browser developer tools, or run the website security checker.
How to fix
Set Secure, HttpOnly and SameSite on session cookies in your application or CMS configuration.
Common mistakes
- Applying HttpOnly to analytics cookies that need script access, then assuming all cookies are flagged
- Forgetting SameSite
Check it with Website Security Checker
Check whether your website uses HTTPS properly, sends security headers, sets safe cookies and avoids mixed content. Free, no sign-up.
Open Website Security Checker