Cookie missing HttpOnly flag: what it is, why it matters, and how to fix it
One or more cookies are set without the HttpOnly flag, making them accessible to JavaScript via document.cookie.
Where this fits: security in SEO
Why cookie missing httponly flag hurts your rankings
Cookies without HttpOnly can be stolen through XSS (Cross-Site Scripting) attacks. If an attacker injects malicious JavaScript, they can read all non-HttpOnly cookies and exfiltrate session tokens or other sensitive data.
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site.
How to fix it
Add the HttpOnly attribute to all cookies that do not need to be accessed by client-side JavaScript. Session cookies should always have HttpOnly set.
Set-Cookie: sessionId=abc123; Secure; HttpOnly; SameSite=StrictFrequently asked questions
What does "Cookie missing HttpOnly flag" mean?
One or more cookies are set without the HttpOnly flag, making them accessible to JavaScript via document.cookie.
Why does cookie missing httponly flag matter for SEO?
Cookies without HttpOnly can be stolen through XSS (Cross-Site Scripting) attacks. If an attacker injects malicious JavaScript, they can read all non-HttpOnly cookies and exfiltrate session tokens or other sensitive data.
How do I fix cookie missing httponly flag?
Add the HttpOnly attribute to all cookies that do not need to be accessed by client-side JavaScript. Session cookies should always have HttpOnly set.
How serious is this issue?
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects cookie missing httponly flag on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by cookie missing httponly flag, and hands you a ready-made fix task.
Check my site free