Communication Security

HttpOnly Flag on Joomla Session Cookies Check

The HttpOnly flag prevents cookie access via JavaScript, protecting user sessions. Check its presence and learn how to enable it to strengthen Joomla session security.

What this test checks

This test checks whether Joomla session cookies are protected by the HttpOnly flag. This flag prevents cookie access via JavaScript, protecting against XSS attacks that aim to steal user sessions. Without it, an attacker can intercept session cookies and impersonate logged‑in users, including administrators.

Our recommendation

Enable the HttpOnly flag for session cookies in the Joomla global configuration by modifying session parameters in configuration.php or via system settings. Test the configuration by inspecting cookies in browser developer tools to verify the presence of the HttpOnly flag.

Security tests

View all tests

CMS Security

HttpOnly Flag on Joomla Session Cookies Check

What this test checks

Our recommendation

Read more

Magento Admin Login Page Protection Check

Login Attempt Limiting Check

Joomla Cron Access Check

PrestaShop Admin Login Page Protection Check

Joomla REST API Access Check

Magento env.php File Access Check

Development File Exposure Check

Cross-Origin-Embedder-Policy Header Check

Upload Folder Indexing Check

Shopify Permissions-Policy Header Check

Shopify X-Frame-Options Header Check

Shopify CSRF Protection Check

Shopify Environment Information Exposure Check

Shopify X-Content-Type-Options Header Check

wp-config.php File Access Check

Drupal Admin Login Page Protection Check

Shopify File Upload Security Check

Database Backup File Exposure Check

Shopify Storefront API Exposure Check

Shopify REST API Exposure Check

PHP Error Display on Drupal Check

Magento Admin Access Check

Shopify Contact Form CAPTCHA Protection Check

WordPress Heartbeat API Check

Shopify API Key Exposure Check

Shopify HTTPS Redirect Check

Known CVE Vulnerability Check on Used Technologies

Shopify Backup File Exposure Check

Database Administration Tools Access Check

Cookie Policy Page Presence Check

Joomla configuration.php File Access Check

admin-ajax.php Accessibility Check

Joomla Backup File Exposure Check

X-Frame-Options Header Check

Shopify SQL Injection Protection Check

Index File Presence in Upload Folders Check

Server Status Pages Access Check

Joomla Temporary Folder (/tmp/) Access Check

WordPress REST API Access Check

Drupal Backup File Exposure Check

Shopify Upload Folder Security Check

Shopify Admin CAPTCHA Protection Check

Malicious File Presence Check in Upload Folders

PrestaShop Session Cookie Security Check

Drupal Log File Exposure Check

Magento Admin Access Restriction Check

Shopify Cookie Consent Banner Presence Check

PHP Error Display on PrestaShop Check

CAPTCHA Presence on Public Forms Check

API Key Exposure Check

WordPress Debug Log Exposure Check

Access to wp-cron.php Check

SQL Query Exposure Check

Shopify HTTP Security Headers Check

CAPTCHA Presence on Admin Page Check

Shopify Terms and Conditions (T&C) Presence Check

Joomla Version Check

Drupal Admin Access Check

Shopify Registration CAPTCHA Protection Check

Joomla Log File Exposure Check

PHP Error Display on Joomla Check

Clear-Site-Data Header Check

Content-Security-Policy Header Check

Magento Backup File Exposure Check

Magento Cache Folder Access Check

Shopify Sensitive File Exposure Check

Cross-Origin-Opener-Policy Header Check

Shopify Content-Security-Policy Header Check

WordPress Admin Access Check

PrestaShop Admin Access Restriction Check

Drupal Version Check

Referrer-Policy Header Check

PHP Error Display on Magento Check

PHP Error Display on WordPress Check

Magento Git File Exposure Check

xmlrpc.php Access Check