Cookie without protection

Why it matters

Cookies keep visitors logged in. A cookie without protection can be intercepted or stolen, and with it someone can take over a session without a password.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the cookies the homepage sets and checks the Secure flag, and HttpOnly on cookies that look like a session or login.

Common causes

• A plugin that sets cookies without these flags
• Server settings that do not add them
• An old login system

How to fix it

1. Set Secure on every cookie.
2. Set HttpOnly on cookies that keep someone logged in.
3. Usually it is a setting of the plugin that sets the cookie. Otherwise ask the host.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "A cookie of your site is not properly shielded". When everything is in order, the report says: "Cookies are properly shielded".