Security of Login Pages: HSTS and Cookie Flags Across 35 Popular Websites (2026)

Reproducible dataset: HSTS and cookie flags (Secure, HttpOnly, SameSite) on the login/homepage of 35 popular sites - the pages where users type passwords. HSTS near-universal (91%); HttpOnly (blocks JS/XSS from reading session cookies) only ~51%, a measurable gap on credential pages. curl-reproducible. Maintained with the guides at PwdFortress. Collected 2026-07-23.