Verifying that a web site sets this flag on any particular cookie is easy. Using an intercepting proxy, like ZAP, you can capture each response from the server and examine any Set-Cookie headers it includes to see if the secure flag is set on the cookie.