The fix, in one snippet
Chrome / Edge / Brave:
chrome://settings/cookies > "Block third-party cookies"
Firefox:
Settings > Privacy & Security > Enhanced Tracking Protection > Strict
Safari:
Settings > Privacy > tick "Prevent cross-site tracking"Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan page embeds an iframe from a second domain that Scan.now controls. Inside the frame, a probe endpoint sets a cookie with SameSite=None; Secure, then a second request checks whether the cookie came back. The frame also reads document.cookie and calls document.hasStorageAccess(). Because Firefox partitions third-party cookies per top-level site rather than blocking them, we also compare the cookie set during a first-party visit to the probe domain with the one seen inside the frame: if they differ, cookies are partitioned and the check passes. The result is one of blocked, partitioned or allowed; only "allowed" fails.
Chrome and Edge still allow third-party cookies by default (Google withdrew its plan to remove them in 2024 and in 2025 said it would not add a new prompt), Safari blocks them, Firefox partitions them and Brave blocks them.
Why it matters
An advertising or analytics domain embedded on thousands of sites receives one cookie per browser and therefore sees every page that embeds it. That cookie is the identifier that joins your visits into a profile, which is sold or used for targeting. Allowing third-party cookies also means cross-site requests carry your session cookies unless the site set SameSite correctly, which is the basis of cross-site request forgery. Chrome and Edge users on default settings are the largest affected group.
How to fix it
Chrome: Settings > Privacy and security > Third-party cookies > "Block third-party cookies". Edge: Settings > Cookies and site permissions > Manage and delete cookies > "Block third-party cookies", or set Tracking prevention to Strict. Firefox: the Standard level already partitions cookies (Total Cookie Protection); Strict blocks known trackers outright. Safari: blocks all third-party cookies by default. Some embedded widgets and single sign-on flows break; browsers handle this with per-site exceptions and the Storage Access API prompt, so allow individual sites rather than the whole category.
Related: the SameSite default check. Guides: cookies explained, automatically deleting cookies and how online tracking works.
Where this fits
Third-party cookies allowed is check 7 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Browser fingerprint uniqueness (medium), where the combination of signals your browser exposes matched no other visitor in our sample, so it could be used to recognise you across sites without cookies. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Third-party cookies allowed closes one route in. Immediately below it: Browser defaults cookies to SameSite=Lax, where your browser sent a cookie that has no SameSite attribute on a cross-site request, so it does not apply the Lax default that limits cross-site request forgery; Canvas fingerprinting exposure, where your browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result can serve as a stable tracking signal; Full referrer sent cross-site, where when you follow a link to another site, your browser sends the full address of the page you came from, including its path and query string.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Third-party cookies allowed (medium severity)
Scanner check id: third-party-cookies
What this check tests: Your browser accepts cookies set by third-party domains embedded in other sites, which is the basic mechanism of cross-site tracking.The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
6 min read · Updated Sep 12, 2026
Cookies Explained: First-Party, Third-Party, SameSite and the Flags That Protect Them
Cookies keep you logged in and also follow you across sites. How they work, the difference between first- and third-party cookies, what...
Read the guide
7 min read · Updated Sep 06, 2026
Automatically Deleting Cookies: Why It Cuts Tracking and How to Set It Up
Deleting cookies when you close a tab breaks the long-lived identifiers trackers depend on while keeping the sites you choose logged in....
Read the guide
8 min read · Updated Sep 02, 2026
How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers
Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...
Read the guide