Why does the report say an authenticated cookie was not assessed?
Secure, HttpOnly and SameSite are important cookie controls, but their correct use depends on the cookie's purpose. An anonymous root-page response cannot demonstrate the security of an authenticated session.
What the engine observes
- Secure attribute on observed cookies
- HttpOnly and SameSite presence
- Names and flag metadata only — never cookie values
Client-readable preference and CSRF cookies may intentionally omit HttpOnly. No cookies observed means not assessed, not automatically safe.
What happens after a check?
Read the observations and their evidence first. Save the private report if useful. To go deeper, verify domain control and agree a precise scope, testing window and resource limits. High-impact candidates remain candidates until appropriate validation is complete.
Read verification policy ↗Related checks
Website security checker ↗Security headers checker ↗SSL & TLS checker ↗Content Security Policy checker ↗CORS signals checker ↗Website vulnerability assessment ↗