Cookie & Tracker Scanner

Follow redirects, list every Set-Cookie, and flag common analytics or ad snippets in the HTML

100% free. This tool needs our server to do the work, so what you submit is sent there, processed and then discarded - it is never stored.

First HTML response only. Cookies and pixels injected after JavaScript or a consent click will not appear.

Jump to the next useful tool without leaving your flow.

See more

About this tool

Cookies are set in Set-Cookie headers, often across redirects, while trackers show up as well-known script snippets in the HTML. This scanner follows the hop chain, lists every cookie with flags (HttpOnly, Secure, SameSite, domain, path, expiry), and flags common analytics or ad pixels such as gtag or a Meta pixel when they appear in the first response body. It is a first-response map, not a 30-day crawl of every XHR. Client-set cookies after load will be missing. Use it to see what a URL actually sets before you write a policy.

How to use this tool

  1. Paste the site URLInclude https. Sample loads a known public page if you only want to see the layout.
  2. ScanRedirects are followed. Each hop's cookies and the final HTML are inspected.
  3. Read cookies and trackersCookie table includes flags. Tracker rows show why a snippet was matched.

Reading the cookie flags

Secure means the cookie is sent only over HTTPS. HttpOnly means page scripts cannot read it, which protects session cookies from cross-site scripting. SameSite controls whether it is sent on requests from other sites: Lax is a good default, and None requires Secure.

Under EU and UK rules, analytics and advertising cookies need consent before they are set. If the scan finds them in the first response, before any choice has been made, your banner is probably not blocking them.

Key features

  • Redirect-aware: cookies on hop 1 are not invisible just because hop 3 is the article.
  • HttpOnly, Secure and SameSite called out per cookie.
  • Common tracker IDs listed with evidence strings.
  • Sample button so you can learn the UI without a customer domain.

Common uses

  • Listing Set-Cookie headers before writing a cookie policy.
  • Seeing whether a marketing site already loads gtag or a Meta pixel.
  • Checking that a staging host is not leaking production tracker IDs.

Tips for better results

  • Compare with GDPR Cookie Banner Audit: this page lists cookies, that page looks for a Reject control.
  • First-party session cookies can be legitimate. The surprise is usually third-party ads.
  • A pixel loaded only after consent will not appear if the HTML we got has not run that script yet.

Mistakes to avoid

  • Calling this a complete inventory of every cookie a long session would set.
  • Assuming a missing tracker means the site is tracker-free after JavaScript.
  • Pasting a URL you are not allowed to test. Stick to sites you own or that are public.

Frequently asked questions

Set-Cookie headers on each redirect hop, with name, preview, domain, path, SameSite, HttpOnly, Secure and expiry. Cookies written only from JavaScript after paint are out of scope.

Common analytics and ad snippets in the HTML, for example gtag-style tags or a Meta pixel, with a short evidence string. It is a signature list, not every possible vendor.

No. It fetches and reads headers plus HTML. That is why it is fast and also why delayed tags are missed.

Yes. First-response scan, not a legal opinion on ePrivacy or GDPR.