> For the complete documentation index, see [llms.txt](https://docs.rafflex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rafflex.io/helpful-info/pci-compliance-scan/pci-scan-cookie-false-positive.md).

# Cookie Vulnerability (Facebook Pixel) False Positive

Why PCI scans sometimes flag the Facebook Pixel cookie, and the response you can submit to mark it as a false positive.

***

Some PCI scans report a "Cookie Vulnerability" against a cookie named `_fbp`, noting that it is missing the **Secure** and **HttpOnly** flags. If you see this in your results, it is a false positive and can safely be marked as one. This page explains why, and gives you a response you can copy and paste into the scan portal.

***

### What is the `_fbp` cookie?

`_fbp` is the Facebook (Meta) Pixel cookie. A cookie is a small piece of information a website stores in a visitor's browser.

When you add your **Facebook Pixel ID** to your site, Rafflex loads Facebook's tracking script on the pages of your site. That script, which belongs to Facebook, places the `_fbp` cookie in your visitor's browser. Facebook uses it to work out which advert a visitor came from, so your ad reporting and targeting work correctly.

It is an anonymous advertising identifier. It does **not** contain any login, session, payment, or card information.

{% hint style="info" %}
**Where is my Pixel ID set?** In your admin panel, open **Settings**, then **Marketing**, and scroll to the **Facebook Analytics** section. If the **Facebook Pixel ID** field has a value in it, the pixel is active on your site. See [Tracking](/marketing/facebook-and-meta/tracking.md) for more about this setting.

If that field is empty but the scan still flags `_fbp`, check whether you (or someone helping you) have added a Facebook pixel by hand in **Settings**, then **Advanced**, under **Header Code** or **Body Code**. The same response below applies either way.
{% endhint %}

***

### Why is it flagged, and why is it safe?

The scanner expects every cookie to carry the Secure and HttpOnly flags. This cookie cannot, for two reasons that are outside our control.

1. **It is not set by our servers.** The cookie is created by Facebook's script running in the visitor's browser, not by your Rafflex site. The Secure and HttpOnly flags can only be applied to cookies that a website's own server issues, so neither we nor you can set them on a Facebook cookie.
2. **HttpOnly is impossible here by design.** The whole purpose of the HttpOnly flag is to hide a cookie from JavaScript (the code that runs inside a web page). The Facebook Pixel needs JavaScript access to that cookie in order to function, so the flag cannot be applied. This is how the pixel is meant to work, not a fault.

Because the cookie holds no sensitive data, the underlying concern the scanner raises (someone stealing session or card information) simply does not apply. There is nothing of value in the cookie to take.

{% hint style="warning" %}
**Should I remove the pixel instead?** The only way to make this finding disappear entirely is to clear the **Facebook Pixel ID** from your marketing settings. That would stop your Facebook ad tracking, including the events (such as purchases) that Rafflex sends to Facebook through the Conversions API, because those also rely on your Pixel ID. Most sites keep the pixel and mark the finding as a false positive instead.
{% endhint %}

***

### How to submit the false positive

1. Follow steps 1 to 7 on the [PCI Compliance Scan](/helpful-info/pci-compliance-scan.md#how-to-deal-with-a-failed-scan) page to find your failed items.
2. Find the failed item that mentions the `_fbp` cookie.
3. Click the **three dots** on the right hand side and choose **Raise False Positive**.
4. Paste the response below into the comment box.
5. Submit the false positive request.

{% hint style="info" %}
Use this response only for the `_fbp` cookie finding. For TLS/SSL, cipher suite and port findings, use the response on the [PCI Compliance Scan](/helpful-info/pci-compliance-scan.md#response-to-paste) page.
{% endhint %}

***

### Response to submit

Copy the whole response below (use the copy button in the top corner of the box) and paste it into the comment box.

{% code overflow="wrap" %}

```
The cookie flagged in this finding (_fbp) is set by the Meta (Facebook) advertising pixel, which runs as third party JavaScript in the visitor's browser. It is not issued by our web servers, so the Secure and HttpOnly attributes cannot be applied to it. By design, a cookie created by client side JavaScript cannot be marked HttpOnly, because that attribute exists specifically to hide a cookie from JavaScript, which the pixel requires in order to function.

The cookie contains only an anonymous advertising identifier used for ad attribution. It holds no authentication, session, payment, or cardholder data, so the information disclosure risk described in the finding does not apply. As the cookie originates from a third party service outside our hosted environment and outside our control, and as it carries no sensitive data, this finding is a false positive and should be marked accordingly.
```

{% endcode %}

{% content-ref url="/pages/nr9VPDCvi35CM9s9s1Ll" %}
[PCI Compliance Scan](/helpful-info/pci-compliance-scan.md)
{% endcontent-ref %}