Matan · Security · Exposure
Cookie flags (Security)
Session cookies need Secure, HttpOnly and SameSite.
Pass condition in our engine: Set-Cookie values include Secure and HttpOnly, or no cookies are set.
This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.
1. Problem description
We parse Set-Cookie on this response. Missing Secure allows HTTP theft; missing HttpOnly allows XSS to read the cookie; missing SameSite eases CSRF. If no cookies are set, the check passes.
2. Most common causes
- A framework default from years ago.
- A tracking cookie without SameSite.
- Secure omitted because HTTPS was added later.
3. How to fix it
- Set Secure; HttpOnly; SameSite=Lax (or Strict) on session cookies.
- Use __Host- cookie prefixes where you can.
- Do not put secrets in non-HttpOnly cookies.
Test this check
We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.
Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.
Get your free website audit
Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.