Cookie flags
What it can report
- ✗ high a session-looking cookie without Secure (low for other cookies) How to fix it
- ! medium a session-looking cookie readable by scripts How to fix it
- ! low a session-looking cookie with no SameSite attribute How to fix it
- ! medium SameSite=None without Secure (browsers drop it; low for non-session cookies) How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 3 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.