Free cookie checker (Set-Cookie flags)
We'll look at the cookies set when the page you enter loads, check whether they use sensible safety settings (Secure, HttpOnly where suitable, and SameSite), and note any scripts we spot that may be used for tracking or advertising. It isn't a full cookie compliance check.
What this checks
This is a passive, light-touch check. It only reads what a normal browser visit and public DNS can see. It isn't a security test, a penetration test or a guarantee.
Check a site
Checking your site… This usually takes under a minute.
What your result means
- Pass: The cookies set by your page have the right safety settings (Secure, HttpOnly where suitable, and SameSite).
- Worth a look: Some cookies are missing safety settings. Or we spotted scripts that may be used for tracking or advertising, from [names]. Under UK rules, most cookies that aren't strictly necessary need visitors' consent before they're set.
- Needs fixing: A cookie that looks like a login or session cookie is sent without the Secure setting.
- How to fix: Ask your developer to add Secure, HttpOnly and SameSite=Lax to your cookies. For trackers, check that your cookie banner asks first. The ICO's guidance on cookies explains the rules. This is a general pointer, not legal advice.
FAQs
What do Secure, HttpOnly and SameSite do?
Secure keeps the cookie on https only. HttpOnly stops page scripts reading it. SameSite limits when the cookie is sent on requests from other sites.
Does a Pass mean my cookie banner is fine?
No. We look at technical flags and obvious tracker scripts. Consent design is separate. Under UK rules, most cookies that aren't strictly necessary need visitors' consent before they're set. This is a general pointer, not legal advice.
Why "may be used for tracking"?
We spot common script addresses, but we can't know how you use them. Treat a mention as a prompt to check, not a verdict.
Do you store the cookies you see?
No. Results are shown to you and then gone, in line with our [Privacy notice].