Direct answer: ten of the 25 homepages set 20 cookies in total: four Secure, 12 HttpOnly and five with SameSite; seven carry none of the three flags and none uses a __Host-/__Secure- prefix; eight sites have at least one cookie without Secure. By name they split into 10 session, three WAF, two language, one tracking and four other cookies. Only attribute counts are published, never names or values.
Every sampled site runs on HTTPS, so Secure was available and simply not used, not unavailable.
Method: one homepage request without cookies
On 2026-11-09 at 06:41 we sent one cookie-free GET to each of the 25 cached-200 homepages, read every Set-Cookie response header and parsed Secure, HttpOnly, SameSite, Max-Age/Expires and name prefixes. Names were grouped into session, WAF, language, tracking and other; names and values stay in the off-site raw record, and only counts are published.
| Measure | Rule | Boundary |
|---|---|---|
| Cookie | Every Set-Cookie in the response | No JavaScript; script-set cookies are invisible |
| Secure / HttpOnly | Counted when the attribute appears | Browser enforcement not tested |
| SameSite | Counted when present; Lax/Strict/None recorded | Undeclared means Lax by browser default, not “no protection” |
| Persistent | Max-Age or Expires present | Session cookies excluded |
| Category | Name keywords: session / waf / lang / tracking / other | Names only, never values |
Result: only four carry Secure
| Measure | Count | Sites |
|---|---|---|
| Sites setting cookies | — | 10 |
| Cookies | 20 | 10 |
| With Secure | 4 | 2 |
| With HttpOnly | 12 | 9 |
| With SameSite | 5 | 5 |
| Persistent (Max-Age / Expires) | 11 | 7 |
| __Host- / __Secure- prefix | 0 | 0 |
| No flag at all | 7 | 2 |
| SameSite=None without Secure | 0 | 0 |
By purpose: half are session cookies
| Category | Count | Note |
|---|---|---|
| Session | 10 | Names containing sess / session / token |
| WAF | 3 | Protection or challenge cookies |
| Language | 2 | Language or locale preference |
| Tracking | 1 | Analytics identifier |
| Other | 4 | Site-specific |
The problems cluster on two sites: E11's six cookies have none of the three flags, and three of them are persistent; one of E02's two cookies also has no flags. The strongest set is E28: all three cookies are Secure and two are HttpOnly, though none has SameSite; E29's WAF cookie combines Secure, HttpOnly and SameSite=None, which is consistent on HTTPS.
Several sites already use HttpOnly and SameSite=Lax on session cookies but miss Secure (E13, E17, E26), a low-cost gap on an HTTPS site; E18, E19 and E20 have HttpOnly but only partial SameSite.
What this means for acceptance
- Set Secure by default on HTTPS. 16 of 20 cookies lack it and eight sites have at least one; this is the cheapest fix.
- Session cookies need HttpOnly. Some of the 10 session cookies still lack it, and E11's session cookie has no flag at all.
- Write SameSite explicitly. Five of 20 have it; browsers default to Lax, but cross-site embeds or payment callbacks need explicit None+Secure.
- Differentiate by purpose. Tracking or language cookies may deliberately omit HttpOnly; the acceptance sheet should set requirements per category.
- Control count and lifetime. Eleven of 20 are persistent; review necessity, expiry and the privacy notice before launch. See the website development service.
Limits
- Single request: one cookie-free GET; cookies set by WAF challenges, login or later API calls are invisible.
- Response headers only: no JavaScript runs, so script reads and tracking use are not judged.
- SameSite definition: attribute presence only; an undeclared cookie defaults to Lax, so absence is not “no protection”.
- Heuristic categories: name keywords can misclassify; names and values are not published.
- 25-site pilot: the same equipment-company sample; no industry claim.
Data and reproduction
Anonymised data: equipment-homepage-cookie-flags-2026.csv (25 rows × 16 columns: cookie count, Secure/HttpOnly/SameSite/persistence, prefixes, no-flag count, categories and time). The repository keeps docs/research/2026-11-homepage-cookie-flags.csv.
Parser: scripts/cookie_flag_probe.py; unit tests: scripts/test_content_cookie_flag_probe.py (11, offline). Run:
python -m unittest scripts.test_content_cookie_flag_probe
Related: the homepage privacy and analytics pilot, the homepage security-header pilot, the homepage CSP pilot, and the cookie flag checker (local Set-Cookie parsing).
Sources and definitions
- Sample: the 25 study-4 homepages cached as 200.
- Fetch: 2026-11-09 06:41 Asia/Shanghai, serial, 0.5 s apart, 15-second timeout, no cookies sent.
- Parsing: Secure, HttpOnly, SameSite, Max-Age/Expires and name prefixes for every
Set-Cookie. - Categories: name keywords only; names and values are not published.
Frequently asked questions
Does missing SameSite mean insecure?
Not necessarily. Chrome, Edge and other modern browsers treat an undeclared cookie as Lax by default; this study records whether the attribute is written, not the effective policy, so SameSite is reported separately rather than folded into “no flag”.
Why fix Secure first?
The sites already run on HTTPS, but a cookie without Secure can still travel over a plaintext request. Only four of 20 set it, and eight sites have at least one cookie without it.
Is more HttpOnly always better?
Session cookies should have it; language preferences or tracking cookies that front-end code reads may deliberately omit it. E28's tracking cookie has no HttpOnly, which looks like a design choice rather than an omission.
Why do only 10 sites set cookies?
The other 15 set none on the homepage response, or set them from scripts or later API calls. This study reads response headers only, without JavaScript or login.
What does zero __Host-/__Secure- prefixes mean?
The prefixes enforce Secure and domain restrictions, but adoption is very low. They are a bonus, not a baseline requirement.
Can the data be re-checked?
Yes. The public CSV has 25 rows by 16 columns, and scripts/cookie_flag_probe.py has 11 offline unit tests.