Cookie Security Check
VitalSite inspects Set-Cookie headers across every page for the Secure, HttpOnly, and SameSite flags that prevent session theft and CSRF.
Cookies often hold session tokens — the keys to a logged-in account. If they lack the right protective flags, those tokens can be stolen by scripts or sent over insecure connections. Unlike many scanners that only look at the homepage, VitalSite inspects Set-Cookie headers across every page it crawls, because login and checkout flows frequently set cookies on deeper pages.
The flags VitalSite checks
- Secure. The cookie is only sent over HTTPS. Without it, the cookie can leak over plain HTTP. Missing Secure is treated as high severity.
- HttpOnly. JavaScript cannot read the cookie, which blocks theft via cross-site scripting (XSS).
- SameSite. Controls whether the cookie is sent on cross-site requests. SameSite=Lax or Strict is the primary defense against cross-site request forgery (CSRF).
Why it matters
A session cookie without HttpOnly can be stolen by a single injected script; one without Secure can leak on any downgraded request; one without SameSite leaves you open to CSRF. Because these flags protect authentication, they are some of the most consequential one-line fixes you can make.
How to fix it
Set the flags wherever your cookies are issued. Most frameworks expose this directly:
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/- Express:
res.cookie('session', value, { secure: true, httpOnly: true, sameSite: 'lax' }) - PHP: set the session cookie params, or session.cookie_secure = 1 and session.cookie_httponly = 1 in php.ini.
- WordPress: ensure the whole site runs over HTTPS so auth cookies get the Secure flag; see the WordPress hardening checklist.
Use SameSite=Strict for the most sensitive cookies and Lax for general session cookies that still need to survive top-level navigation.
Verify the fix
Re-scan and check that each cookie reports CLEAR with Secure, HttpOnly, and SameSite all present. Because VitalSite checks deep pages, log in to your own site before sharing it for a scan if your sensitive cookies are only set after authentication.
Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.