The HTTPS site sets a cookie without the Secure attribute.

COOKIE_NOT_SECURE · Severity: Warning

• WarningCOOKIE_NOT_SECURE

  The HTTPS site sets a cookie without the Secure attribute.

  A cookie without Secure is also sent over plain HTTP, where it can be read on the way. Only the cookie's name is shown in the evidence, never its value.

  Recommendation: Add the Secure attribute to every cookie the site sets.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

All findings