Website Cookie Checker
See which cookies a page sets and whether they are configured safely. The checker reads the Set-Cookie headers of the page response and lists each cookie’s name, flags – Secure, HttpOnly, SameSite, Partitioned – lifetime and domain, guesses its purpose from common names such as _ga or PHPSESSID, and flags problems: missing Secure on https, session cookies without HttpOnly, missing SameSite, SameSite=None without Secure, lifetimes over 400 days, broken __Host- prefixes and very large cookies. Cookie values are never shown or stored.
- Encrypted connection
- No sign-up
- Free to use
How to use Website Cookie Checker
- Enter the page address.
- Click “Check cookies”.
- Review the flags and findings.
- Fix the cookie settings in your application.
Website Cookie Checker features
Security flags
Secure, HttpOnly, SameSite.
Lifetime
Session or duration.
Purpose hints
Analytics, marketing, necessary.
Prefix rules
__Host- and __Secure-.
Privacy
Values never returned.
Safe fetching
Public addresses only, with size and time limits.
When to use Website Cookie Checker
- Security reviews.
- GDPR and cookie banner checks.
- Debugging login problems.
- Checking framework defaults.
Website Cookie Checker FAQ
Why are some cookies missing?
Cookies set by JavaScript (analytics, consent tools) after the page loads are not in the HTTP response. Check them in your browser’s developer tools.
What does SameSite do?
It controls whether a cookie is sent with requests from other sites, protecting against cross-site request forgery.
Why limit lifetime to 400 days?
Chrome caps cookie lifetimes at 400 days; longer values are shortened.
Do I need consent for these cookies?
Strictly necessary cookies usually not; analytics and marketing cookies usually yes under GDPR/ePrivacy. This is not legal advice.
Which flags should a login cookie have?
Secure, HttpOnly and SameSite=Lax or Strict, with a reasonable lifetime. Together they protect against theft over insecure connections, script access and cross-site request forgery.
Why are cookies set by scripts not shown?
This check reads the Set-Cookie headers of the page response. Cookies created later by JavaScript only exist in the browser; inspect them in your browser’s developer tools.
Do I need consent for every cookie?
Rules depend on your region. In the EU and UK, strictly necessary cookies are usually exempt, while analytics and marketing cookies generally need consent.
Cookies configured safely
Session cookies should be Secure, HttpOnly and SameSite=Lax or Strict. These three flags block the most common cookie theft and forgery attacks.
Keep cookies small and few; every cookie is sent with every request to its domain.
The checker reads the Set-Cookie headers of the page response and lists each cookie with its flags and lifetime. Secure keeps a cookie off plain http, HttpOnly hides it from JavaScript (important for session cookies), and SameSite controls whether it is sent with requests from other sites.
Problems are flagged: session cookies without HttpOnly or Secure, SameSite=None without Secure (which browsers reject), very long lifetimes and overly broad domains. Common names such as _ga or PHPSESSID are recognised to suggest a cookie’s purpose.
Only cookies set by the page response itself are visible here; cookies set later by JavaScript or third-party scripts need a check in the browser. Use the result to update your cookie policy and consent banner.
Use the result to keep your cookie policy and consent banner accurate. List every cookie the server sets with its purpose and lifetime, remove cookies nobody uses, and give session and login cookies the Secure, HttpOnly and SameSite flags. Check again after adding plugins or third-party services, which often set new cookies.
Third-party cookies from embedded services such as videos, maps or chat widgets are set by those services’ own domains, so check pages that include such embeds separately in your browser. They usually need to be covered by your consent banner as well.