Cookie & Tracker Scanner
Before anyone accepts a banner, your page may already be setting cookies and calling third parties. This free scanner loads your page in a real browser, never touches the banner, and lists the cookies, storage keys and requests that fired first. Observations, not a compliance verdict.
This checked one URL, once.
VitalSentinel Inspector audits the whole page in one pass: this check plus every other technical SEO and performance issue on it, scored and ordered by what to fix first.
Free plan, no credit cardWhat it checks
- Loads the page in a real browser and records the cookies, storage keys and requests it sets
- Never clicks, accepts or dismisses the consent banner, so what you get back is the pre-consent state
- Reads each cookie's HttpOnly, Secure, SameSite and expiry settings, and flags SameSite=None without Secure and lifetimes past Chrome's 400-day cap
- Groups third-party requests by domain and names the analytics, advertising, session recording, tag manager, live chat and marketing vendors it recognizes
What it does not
- It is not a compliance check. Whether a cookie needs consent depends on its purpose, your jurisdiction and the legal basis you rely on.
- It reads one page about 2.5 seconds after it loads. Cookies set later, after a login or after someone clicks the banner are missed.
- It runs as VitalSentinel Free Tools Bot and not from your country, so a site that varies its banner or its tags by bot detection or region can behave differently for a real visitor.
- Every count is a floor, not a total. A cookie set by a third party with HttpOnly cannot be seen by any external scanner, and one run reads up to 100 Set-Cookie lines, 200 cookies visible to JavaScript and the first 500 requests, saying so on the list when it stops there.
Questions
- Does this tell me whether my site is GDPR compliant?
- No, and it never says anything of the kind. It reports what a page did before any consent interaction. Whether that needs consent depends on each cookie's purpose, your jurisdiction and the legal basis you rely on.
- Why does the scan not click my consent banner?
- Because the pre-consent state is the one you cannot easily check yourself. Once a banner is accepted, everything firing is expected, and guessing which button is which across thousands of banner designs is not reliable.
- It found fewer cookies than my browser shows. Why?
- Several reasons. A cookie set by a third party with HttpOnly is invisible to any scan from outside, your own browser is carrying cookies from earlier visits, and this scan reads the page about 2.5 seconds after it loads. Cookies set on a redirect hop are not counted either, and one run stops at 100 Set-Cookie lines and 200 cookies visible to JavaScript. Every count here is a floor.
- The scan failed on a Content Security Policy. Why?
- The scan reads what a page set by running a small script inside it, and a strict Content Security Policy can stop that script running. A page that navigates somewhere else mid-load looks identical from here, so the error names both rather than diagnosing one. Either way we report the failure instead of an empty result, because "no cookies found" would read as a clean bill of health. The Application tab in your own browser's developer tools is the fallback.
More free tools
Fair use, and how to recognize us
3 per minute · 15 per hour · 40 per day per IP (per /64 for IPv6), plus a per-site limit
Every request these tools make sends this user agent, including the ones that load a page in a real browser. What a run records is set out in our privacy policy.
Mozilla/5.0 (compatible; VitalSentinel Free Tools Bot/1.0; +https://www.vitalsentinel.com/bot)
Stop checking by hand
Uptime, Core Web Vitals, indexing and robots.txt, monitored continuously. Start on the free plan and add your first domain in under a minute.