Cookies on home pages in 2026: how many are set immediately, and with which attributes

On 27 August 2026 we requested the home pages of 600 hosts once, without interaction — exactly as a visitor does before pressing any button in a consent banner. Then we looked at which cookies that first response already sets:

Russian sites set cookies on the very first response nearly twice as often as .org, and carry more of them per site on average.

An important caveat about what this does and does not mean. Not every cookie set immediately requires consent: a session identifier, an interface language, cross-site request forgery protection — all are technically necessary. They cannot be told apart from analytics cookies by a header alone, so we do not claim that 59% of sites break the rules. We measured the volume of what is set before any user choice — what each cookie is for is a separate question.

This measurement also misses cookies set by JavaScript after load, and there are usually more of those. The real numbers are higher than the measured ones.

On Secure and SameSite, .ru sits within the general range. But HttpOnly is present on only 32% of cookies — rarer than in any other zone.

What that means in practice: a cookie without HttpOnly is readable from JavaScript. If a foreign script reaches the page — through a vulnerability, a compromised third-party widget, or a substituted ad network — it can read that cookie and carry it away. For a session identifier that means session hijacking.

Caveat: some cookies are read from JavaScript deliberately — an analytics identifier, saved interface preferences. For those the absence of HttpOnly is normal. So 32% is not the share of vulnerable cookies but the upper bound of the set worth looking through.

1. Find your session identifier and confirm it carries all three attributes: Secure, HttpOnly and SameSite=Lax (or Strict). It is the one cookie where a mistake costs most.
2. Check that SameSite=None appears only where a cookie genuinely needs a third-party context — an embedded widget or a payment form. Such a cookie must also carry Secure, or the browser discards it.
3. Look at what is set before the consent banner. Technically necessary cookies need no consent; analytics cookies do. They can be separated only by purpose, and only by someone who knows what each cookie does.
4. Account for cookies set by JavaScript. Response headers do not show them; look in the developer tools storage tab.

To break down a specific site’s cookies with their attributes, use the cookie analyser.