Cookie 安全属性

为何重要

Cookies without the Secure, HttpOnly and SameSite flags can be sent over insecure connections, read by injected scripts or attached to cross-site requests. Session cookies are the most sensitive.

如何修复

1. Add Secure so the cookie is only sent over HTTPS.
2. Add HttpOnly to every cookie that JavaScript does not need to read.
3. Add SameSite=Lax (or Strict) to reduce cross-site request forgery.

使用以下工具检查

• HTTP Headers Checker – View all HTTP response headers for a URL, with notes on the ones that matter for SEO.
• Security Headers Checker – Grade a site’s HTTP security headers (CSP, HSTS, X-Frame-Options and more).

评分：通过的检查获得全部权重，警告获得一半，错误则不得分。 SEO 评分如何运作

测试您的页面 全部检查