When you log into a website, it typically gives your browser a cookie — a small piece of data that proves you're logged in on every subsequent request, so you don't have to re-enter your password on every page. If that cookie is stolen, whoever has it can impersonate the logged-in user without ever knowing their password. Three flags control exactly how exposed that cookie is.
| Flag | Plain English |
|---|---|
| Secure | Ensures the cookie is only ever sent over an encrypted HTTPS connection, never over plain HTTP where it could be intercepted. |
| HttpOnly | Blocks JavaScript from reading the cookie at all — meaning that even if an attacker manages to inject malicious script onto your page, they still can't steal the session cookie through it. |
| SameSite | Controls whether the cookie is sent when a request originates from a different site — a key defence against cross-site request forgery (CSRF). |
These three flags cost nothing to set and require no changes to how your site actually functions for legitimate visitors — they're a pure security upgrade with no user-facing tradeoff, which makes missing flags one of the more inexcusable gaps a scan can find.
Most modern web frameworks set these flags by default on session cookies, or make them a single configuration option. Custom or legacy cookie-setting code is the most common place these get missed.
PEKRYON scans your website across 26 modules. We take the time needed for accurate results — no server access needed.
Scan My Website Free → Learn More