HTTPS-only transport
Secure restricts a cookie to secure transport. SameSite=None also requires Secure in modern browsers.
Website security
Review cookie security attributes without exposing values.
The checker keeps cookie contents out of results and inspects only names and attributes that affect browser handling.
Result
Website security observations
What to review
Read the finding in context.
JavaScript access
HttpOnly can keep a server-managed session cookie out of document.cookie and reduce the impact of some XSS paths.
Cross-site requests
Lax and Strict reduce when cookies accompany cross-site requests. The right value depends on login/payment/integration flows.
__Host- and __Secure-
Cookie prefixes impose additional browser rules when supported and can make intended scope easier to audit.