Cookie is missing the HttpOnly flag
What does this mean?
At least one cookie your site sets doesn't have the HttpOnly attribute, meaning any JavaScript running on the page can read it — including your own scripts, third-party scripts you've embedded (ads, analytics, widgets), and anything an attacker manages to inject via a cross-site scripting (XSS) vulnerability. HttpOnly cookies are invisible to JavaScript entirely, which removes that avenue outright.
What are the potential impacts?
- If an attacker finds any way to run their own JavaScript on your page (a classic XSS vulnerability), a non-HttpOnly session cookie lets them steal it directly and impersonate the logged-in visitor.
- Third-party scripts you embed (ad networks, chat widgets, analytics tags) can also read non-HttpOnly cookies, expanding who has access to session data beyond just your own code.
- This turns what might otherwise be a low-severity XSS bug into a full account takeover, since the two combine into a much more serious real-world attack.
How to fix it
Add the HttpOnly attribute to cookies that don't need to be read by client-side JavaScript — this is typically a single configuration flag alongside Secure (e.g. httponly=True in Flask/Django, cookie.httpOnly = true in Express). Note: some cookies are legitimately meant to be readable by JavaScript by design (e.g. a CSRF token cookie your frontend code needs to echo back) — HttpOnly should be applied to session/authentication cookies specifically.
Want to see whether this actually affects your site? Run a free scan — no signup required.
Run a free scan