Cookie Check: Flags, Lifetimes, and Owners
What your site and third-party widgets set, which flags are mandatory for session cookies, common findings, and why the consent banner should be checked not only legally.
Cookie check shows which files the site saves, who sets them, and how securely they are configured. This is necessary for compliance with personal data regulations and simply to understand what is happening on your site. The tool is cookie analysis.
What to Look for in the Results
| Parameter | What It Means |
|---|---|
| HttpOnly | Cookie is not accessible to scripts — mandatory for session cookies |
| Secure | Transmitted only over https |
| SameSite | Limits sending from foreign sites, protects against request forgery |
| Lifetime | Session or long-term: a year for analytics is normal, for login — not |
| Owner | Your domain or a third-party service |
Common Findings
- Session cookie without HttpOnly — it can be read by a third-party script: this is a direct path to session hijacking.
- No SameSite — browsers apply defaults themselves, but it is not advisable to rely on them.
- Analytics set before consent — a typical complaint during compliance checks.
- Dozens of third-party cookies from widgets that have long been forgotten: chat, map, old pixel.
The Cookie Banner Could Cost You Conversions
We had a case where the consent banner covered the registration button on mobile — ad traffic was coming in, but there were no registrations. Check not only the legal part but also that the banner does not obscure the main action on the screen.Cookies and Analytics
A separate topic is third-party cookies: they are set by widgets, advertising system pixels, and external chats. Browsers are gradually restricting such cookies, so part of the familiar analytics will stop working by itself over time. It is useful to review the list every six months: usually, half of the scripts on the site relate to experiments that have long ended.
What to Do with Findings
- Set HttpOnly and Secure for all service cookies.
- Explicitly set SameSite based on whether sending from other domains is needed.
- Remove third-party scripts that are no longer used — along with their cookies.
- Check that analytics and pixels are triggered after consent if required in your countries.
- Compare the result with the Shield report — cookie flags are included in its checks.
FAQ
What flags are mandatory?
For service and session cookies — HttpOnly and Secure, and SameSite should be set explicitly, not relying on the browser's default.
What is dangerous about a cookie without HttpOnly?
It can be read by a third-party script on the page — this is a direct path to user session hijacking.
What to check in the consent banner?
Not only the text but also that it does not cover the main button on mobile: such a banner can reset conversion from ads.
Was this article helpful?
Thank you! We will consider this in future updates.
Try it on your project
Everything described in the article is available in the dashboard — the registration bonus is already in your balance.
Open dashboard