The scanner
A scan visits your site the way a new visitor would, then again after accepting everything, and tells you what changed. This page explains how it works and how to read the report.
What a scan does
- It finds your pages. It reads the sitemaps that your
robots.txtnames, or/sitemap.xmlwhen there are none. It spreads its visits over the sections of your site, so a shop with thousands of products still gets its checkout pages seen. When the sitemap holds too few pages, it follows the links on your home page. - It visits them before consent. A fresh browser opens each page and never makes a choice. Everything set at this point was set before the visitor could say anything.
- It visits them after consent. A second fresh browser accepts everything on the first page and then visits the rest. This shows what your site sets once a visitor agrees.
- It checks the privacy signal. One more visit to your home page sends Global Privacy Control, to see whether your site respects it.
- It checks your cache. It compares your home page with a fresh copy, to find a cache that still serves pages without the Cookiemark line.
For each visit the scanner records the cookies, the scripts and the other domains your page contacts. The difference between the two visits is the heart of the report.
Reading the report
The report starts with what needs your attention. A finding marked as a problem is something a regulator would object to. A finding marked to check needs a human look.
- A provider that sets cookies before the visitor chooses, with the pages where it happens.
- Cookies that no list recognises, so they have no category yet.
- Pages where the Cookiemark script is missing.
- A cache that still serves your site without the script.
- Tag Manager loading twice, so every tag fires twice.
- A Google tag that starts before the Consent Mode defaults.
- Pages that could not be checked, for example because they did not load.
Below that is a list of checks, each passed, failed or skipped:
| Check | What it looks at |
|---|---|
| No cookies that need consent before the visitor chooses | Only necessary cookies may appear before a choice. |
| Reject is on the first screen | A reject button that is visible next to accept, not hidden behind a second click. |
| No boxes ticked in advance | Every optional category starts switched off. Checked for Cookiemark banners only. |
| Consent Mode set before Google tags | The consent defaults come before any Google tag on every page. |
| Tag Manager loaded once | No container loads twice. |
| Global Privacy Control respected | No cookies that need consent when the browser sends the signal. |
| Script found on every page | The Cookiemark line is on every page the scan visited. |
| Privacy or cookie policy linked from the banner | The banner links to a policy. Checked for Cookiemark banners only. |
Naming the cookies
For every cookie it finds, the scanner looks in three places. It tries your own cookie list first, then the services Cookiemark knows, then a shared database built from the Open Cookie Database. A match gives a category, a provider, a purpose and a retention period. A cookie without a match is listed as unknown.
The report suggests the cookies that are not on your list yet. Tick the ones you want, press the button to add them, and publish. They then appear in the preferences window. Read the suggestions before you add them, because a name can mean different things on different sites.
How many pages, and how often
The number of pages per scan depends on your plan. We keep these limits generous, and they do not set the price.
| Plan | Pages per scan | Scheduled scans |
|---|---|---|
| Free | 20 | Every month |
| Solo | 100 | Every month |
| Business | 300 | Every month or every week |
| Agency | 1,000 | Every month or every week |
| Agency Plus | 1,000 | Every month or every week |
A new site is scanned every month unless you change the schedule on its Scan tab. You can also set it to scan only when you start one. Scheduled scans run for published sites whose domain is verified, which happens the first time a scan finds your script on the site.
You can start a scan by hand whenever you like, with ten minutes between two scans of the same site. Owners, admins and editors can start one. People at a client cannot.
The free scan
Anyone can scan a site at cookiemark.com/scan without an account. That scan visits 5 pages and runs the same checks. To keep it free for everyone, one visitor can run three free scans a day.
Who visits your site
Scans run in a Chromium browser on our servers in the EU. The browser identifies itself in its user agent with CookiemarkScanner/1.0. If a firewall or bot filter blocks it, the report says which pages it could not check. Allow that user agent to let scans through.
Your statistics stay clean
The scanner loads every script on your pages, as a visitor's browser would. It does not let the requests through that report a visit to Google Analytics, Google Ads, Meta, LinkedIn, TikTok, Pinterest, Microsoft Clarity, Hotjar, Bing, HubSpot, Matomo, Plausible, Fathom or Umami. It answers those itself, so a scan never counts as a page view, a session recording or a member of an ad audience.
The report still shows that the request was made, and before or after consent. A few advertising cookies, such as fr from Meta and IDE from Google Ads, are set by the platform's answer to that request. The report lists them as expected, with a dashed outline.
The scanner only visits public addresses. It refuses private networks, the machine it runs on and the internal addresses of cloud providers, also when a page tries to send it there.
What a scan cannot see
- Pages behind a login, such as a customer account.
- Steps that need a visitor to do something, such as filling a basket or sending a form.
- Cookies set only in some countries, or only after a visitor has been on the site for a while.
- Pages that neither the sitemap nor the home page links to.
Quick scans and full scans
Most cookies come from the template of a site, so they are on every page. Scanning thousands of product pages tells you little that twenty well-chosen pages do not. That is why there are two kinds of scan.
- A full scan visits as many pages as your plan allows: the start page, then a page from every section, then the rest. It takes at most a few pages built from the same template, such as product pages, and spends the rest on pages that differ. Scans you start yourself and monthly scans are full scans.
- A quick scan visits up to 40 pages: the pages that were wrong in the last scan, the pages your sitemap says changed since, and one or two pages from every section. On a weekly schedule you get a quick scan every week and a full scan every four weeks.
Scans skip video and web fonts, which set no cookies. A request to a font service still counts as a contacted domain, so you still see it in the report.