Cookie scanning - how to find out what your site really stores
Before you describe cookies in a policy and group them in a banner, you need to know what your site actually stores. Almost nobody knows this from memory: cookies arrive with plugins, ad pixels, chat widgets, maps and a tool someone added three years ago and never mentioned.
Why a hand-written list always drifts
The typical cookie list is written once, when the privacy policy goes live, and ages with every deployment after that. Marketing adds a pixel and the document stops matching reality. At an inspection, that gap between what you declare and what you do is the easiest thing to demonstrate.
What an automated scan finds
A scanner fetches pages of your site and looks at two things:
Set-Cookieheaders - the cookies set server-side.- Third-party signatures in the HTML - GA4, Meta Pixel, Hotjar, YouTube, Clarity, LinkedIn, TikTok, Matomo and the like. From those it adds the cookies those services set, with purpose and duration.
A good scan does not stop at the home page: it starts there, adds URLs from sitemap.xml and internal links, and aggregates across subpages. Cookies often appear only in the cart, on a product page or on the contact form.
What a scan will not see
Worth knowing the limits, because no tool removes the need for judgement here. Scanners working over HTTP do not execute JavaScript, so they miss cookies set only after an interaction - a click on a video player, opening a chat, dismissing a pop-up.
The practical conclusion: a scan result is a starting point, not the final truth. Dynamically loaded trackers have to be tagged by hand and added to the list.
Scanning is not a one-off
Your site keeps changing, so the inventory has to as well. A sensible rhythm is at least monthly, and for a shop that deploys often, daily.
CookieFox scans automatically at a cadence set by your plan, aggregates cookies across every page it crawled, and feeds them into both the banner categories and the generated cookie policy. Autoblocking holds the detected scripts until consent.
Scan your site for free. For writing the result up, see what a cookie policy must contain.