The fix, in one snippet
chrome://settings/help (Firefox: Menu > Help > About Firefox)
Chrome 80 and later default to SameSite=Lax. Firefox uses Total
Cookie Protection instead, which achieves the same isolation.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan briefly navigates through a Scan.now probe domain, which sets a cookie with no SameSite attribute as a first party and redirects back. The scan page then makes two cross-site requests to the probe: an <img> GET and a form POST submitted into a hidden iframe. The probe reports whether the cookie arrived on each. The check passes when the cookie is withheld on both, whether because the browser defaults to SameSite=Lax (Chrome and Edge since version 80) or because it partitions or blocks third-party cookies (Firefox Total Cookie Protection, Safari, Brave). We deliberately avoid a top-level POST because Chrome exempts cookies younger than two minutes from Lax on those.
Limits: Firefox has not enabled Lax-by-default, so its pass depends on Enhanced Tracking Protection being on, which it is by default.
Why it matters
Cross-site request forgery: a page you visit makes your browser send a request to your bank, webmail or router with your session cookie attached, and the server cannot tell it from a request you made. Sites that set SameSite explicitly are protected regardless of the browser. The browser default protects the many sites that never set it. If your browser sends attribute-less cookies cross-site and also allows third-party cookies, you carry the full CSRF exposure of every site that forgot the attribute.
How to fix it
Chrome and Edge: update; Lax-by-default has been standard since 2020 and only an outdated build or an enterprise policy override changes it. Firefox: keep Enhanced Tracking Protection on (Standard or Strict), or block third-party cookies under Settings > Privacy & Security > Custom. Safari and Brave: pass by default. Blocking third-party cookies (see that check) closes the same gap from a different direction. Site owners should not rely on the default at all:
Set-Cookie: session=…; Secure; HttpOnly; SameSite=LaxSee the website-side SameSite check, cookie security flags and cookies explained.
Where this fits
Browser defaults cookies to SameSite=Lax is check 8 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Third-party cookies allowed (medium), where your browser accepts cookies set by third-party domains embedded in other sites, which is the basic mechanism of cross-site tracking. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Browser defaults cookies to SameSite=Lax closes one route in. Immediately below it: Canvas fingerprinting exposure, where your browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result can serve as a stable tracking signal; Full referrer sent cross-site, where when you follow a link to another site, your browser sends the full address of the page you came from, including its path and query string; Global Privacy Control signal, where your browser is not sending the Global Privacy Control signal, so sites that are legally required to honour opt-outs will not receive yours automatically.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Browser defaults cookies to SameSite=Lax (low severity)
Scanner check id: samesite-defaultThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 05, 2026
Cookie Security Flags: Secure, HttpOnly, SameSite and Cookie Prefixes
A session cookie without the right flags can be stolen over HTTP, read by injected script or sent in a forged cross-site request. Each...
Read the guide
6 min read · Updated Sep 12, 2026
Cookies Explained: First-Party, Third-Party, SameSite and the Flags That Protect Them
Cookies keep you logged in and also follow you across sites. How they work, the difference between first- and third-party cookies, what...
Read the guide