Without Secure a cookie can leak over plain connections, without HttpOnly a script can steal it, and without SameSite it is weak to CSRF. We read the response headers only.
Read-only external check · free for personal use · daily monitoring for business
Check now, free →Enter one domain and we read only what anyone can see on the internet to gather the risks. We send no attack requests, separate hard evidence from heuristic signals, and write “not seen” for what we could not observe.