EngineeringScoreFree cookie checker
Check whether your cookies carry the Secure and HttpOnly attributes, and see which third parties are setting cookies through your site, in one scan, no signup.
We read one page, in one state, without signing in. Being clear about the edges is the point: a scanner that implies it sees everything is the one to distrust. See exactly what we can't see →
- 4 checks each pass, fail, or needs review
- Under a minute one page, one scan
- No signup no account, no email
What we check
Secure attribute
Set-Cookie: name=value; Secure, checked on every first-party cookie when the page is served over HTTPSEvery eligible first-party cookie carries Secure. We name any that do not, and note when a long-lived HSTS policy already limits the real-world risk.
A cookie without Secure can be sent over a plain HTTP connection if one is ever made to your domain, handing whatever that cookie carries, a session token, an auth flag, to anyone intercepting that one request.
Learn more about Secure attribute →Secure attribute (vendor-managed cookies)
The same Secure attribute check, applied separately to cookies matching known analytics and ad patterns, for instance _ga, _gcl_au, _clck, _fbpThis checkId is used only when every cookie missing Secure is a recognised vendor cookie; a single app cookie among them sends the entire finding to security.cookies-secure above, with its own severity. Here it is capped at minor: the cookies are first-party by domain, but a vendor script writes them, not your server.
The interception risk is identical to any missing Secure attribute, but the fix lives in the vendor's dashboard, for example an analytics tool's cookie flag setting, not in a line of your own code.
Learn more about Secure attribute (vendor-managed cookies) →HttpOnly attribute
Set-Cookie: name=value; HttpOnly, skipped for cookies that must stay readable by page JavaScript to work at all, like _gaEvery eligible first-party cookie carries HttpOnly. We name any that do not.
A cookie without HttpOnly can be read by any script running on the page, so one XSS bug anywhere on the site turns into full session theft instead of a contained defect.
Learn more about HttpOnly attribute →Third-party cookies
Any cookie whose domain does not match the site being scanned, grouped by the vendor that sets it, for example Google Analytics, Meta Pixel, Microsoft ClarityNever scored as a defect on your site: we name the vendors writing cookies through your pages, because most owners have not actually counted them.
Each additional vendor is a script with write access to your visitors' browsers, not a flaw in your own code, and most sites never total up how many they are actually running.
What we can't see
- Anything about your cookies at all, when we cannot resolve the scanned URL to a host. Secure, HttpOnly, and third-party then report as skipped rather than scored, because an empty first-party cookie list in that case means unknown, not clean, and a pass we never earned is worse than a gap we admit to.
- Cookies set after a user interaction, a login, a consent-banner click, a checkout step: we read the page as it first loads, once.
- Whether a cookie's value itself is sensitive. We check attributes, Secure, HttpOnly, first-party or third-party, not what's inside the cookie.
- SameSite behaviour: we currently check Secure and HttpOnly, not the SameSite attribute.
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.