Communication Security

Cookie Security Check

Learn how to check the Secure, HttpOnly, and SameSite flags on your cookies to strengthen session security and prevent session hijacking and XSS attacks.

What this test checks

This test verifies that your site's cookies are protected by the following security flags: Secure (transmitted only over HTTPS), HttpOnly (inaccessible via JavaScript), and SameSite (restricted to same‑site requests). These flags prevent session hijacking and XSS attacks.

Our recommendation

Configure session and authentication cookies with the Secure, HttpOnly, and SameSite flags. In Laravel, this is done via config/session.php by setting the appropriate options. For custom cookies, use the relevant parameters when creating them. Test the configuration using browser developer tools.

Security tests

View all tests

Data Exposure

Cookie Security Check

What this test checks

Our recommendation

Read more

Magento Git File Exposure Check

CAPTCHA Presence on Password Reset Form Check

Clear-Site-Data Header Check

Shopify Content-Security-Policy Header Check

Shopify X-Frame-Options Header Check

WordPress Version Check

CAPTCHA Presence on Client Login Page Check

PHP Error Display on Joomla Check

WordPress Login Page Access Check (wp-login.php)

Magento Admin Login Page Protection Check

Authentication File Exposure Check (.htpasswd, .user.ini)

PHP Error Display on PrestaShop Check

Joomla Cron Access Check

Shopify Storefront API Exposure Check

Content-Security-Policy Header Check

Drupal Backup File Exposure Check

Malicious File Presence Check in Upload Folders

Privacy Policy Page Presence Check

Drupal Log File Exposure Check

WordPress Backup File Exposure Check

Server Configuration Information Check

Shopify Admin CAPTCHA Protection Check

Shopify HTTPS Redirect Check

CORS Configuration Check (Access-Control-Allow-Origin)

Joomla configuration.php File Access Check

Drupal Upload Folder Indexing Check (sites/default/files/)

Database Administration Tools Access Check

Drupal Admin Access Restriction Check

PrestaShop Upload Folder Indexing Check

Magento env.php File Access Check

Directory Indexing Check

Cache Policy Check (Cache-Control, Pragma, Expires)

Shopify Error Display Check

Shopify HTTP Security Headers Check

X-Frame-Options Header Check

Shopify X-Content-Type-Options Header Check

Shopify Admin Access Restriction Check

Shopify Client Login CAPTCHA Protection Check

PHP Error Display on WordPress Check

Shopify Version Check

Shopify phpinfo Exposure Check

Shopify Referrer-Policy Header Check

Shopify XSS Protection Check

PrestaShop Log File Exposure Check

Joomla configuration.php Exposure Check

Joomla REST API Access Check

Database Backup File Exposure Check

Development File Exposure Check

Cross-Origin-Resource-Policy Header Check

Cookie Policy Page Presence Check

Plaintext Password Exposure Check

Joomla Log File Exposure Check

Shopify Password Protection Check

Shopify Registration CAPTCHA Protection Check

Shopify Permissions-Policy Header Check

Permissions-Policy Header Check

Upload Folder Protection Check (.htaccess, index.html files)

Access to wp-cron.php Check

Shopify Upload Folder Security Check

Magento Configuration File Exposure Check

admin-ajax.php Accessibility Check

WordPress Theme Editor Access Check

Joomla Administrator Interface Access Check

Configuration File Exposure Check

WordPress Admin Access Check

Magento Cache Folder Access Check

Shopify Contact Form CAPTCHA Protection Check

Joomla Backup File Exposure Check

PHP Error Display in Production Check

Magento Log File Exposure Check

CAPTCHA Presence on Admin Page Check

Referrer-Policy Header Check

Upload Folder Indexing Check

CAPTCHA Presence on Contact Form Check

API Key Exposure Check

xmlrpc.php Access Check