Cookie Scanner
Enter a page address to see every cookie the server sets, with its lifetime, Secure, HttpOnly and SameSite settings, a plain category guess, and the third-party scripts that usually set more.
Questo contenuto è in inglese.
Esempi svolti
Cookies from a homepage response
https://example.com typed in
(Illustrative) One cookie named sid set by the server, with a category of Necessary as a guess from its name, and a note that the scan follows up to five redirects.
Cookies that scripts set later in a browser cannot be seen, so the list is a starting point rather than complete.
Analytics style cookie
https://example.com/shop typed in, where the server sets a cookie named visitor_id
(Illustrative) visitor_id listed with a category of Analytics as a guess from well-known names, not a legal classification.
Categories are guesses from a list of common cookie names, so check each cookie yourself before relying on the label.
Informazioni su Cookie Scanner
A cookie scanner lists the cookies a website sets when someone loads a page. Enter an address and Valtrinity requests the page, follows up to five redirects, and records every Set-Cookie header it sees. For each cookie you get the name, domain, path, lifetime, and the Secure, HttpOnly and SameSite settings, plus a plain guess at whether it is necessary, functional, analytics or advertising, taken from a list of well-known cookie names. Each flagged cookie comes with a short note on what to change, so you can pass a clear list to whoever looks after the site.
The report also lists scripts and tracking pixels in the page code that typically set cookies, such as analytics, advertising and chat tools, and flags weak settings like a sign-in cookie that scripts can read. It can only see cookies sent by the server. Cookies that scripts set later in a real browser cannot be seen here, so this is a starting point for a cookie review. It is a guide, not legal advice. The scan sends no cookies and does not interact with any banner, and cookie values are never shown, only their names, settings and lifetimes.
Come usare Cookie Scanner
- Type the address of the page to scan.
- Select Scan cookies.
- Read the verdict and the problems to fix at the top.
- Review the table of cookies and the category guess for each.
- Check the list of scripts and pixels, then compare with your cookie notice.
Usi comuni
- Checking that sign-in and session cookies have the right security settings
- Finding analytics and advertising cookies that are set before a visitor agrees
- Preparing a list of cookies for a cookie policy or consent banner
- Seeing which tracking scripts a page loads
- Checking cookies set during redirects from an old address
Domande frequenti
Which cookies can the scanner see?
Only those the server sets in its response headers, including during up to five redirects. Cookies created later by scripts running in a browser, for example by analytics and advertising tags, are not visible to this scan. A page with no listed cookies may still set some in a real browser.
How are cookies put into categories?
By matching each name against a table of well-known cookies, such as those used by common analytics, advertising, security and shop tools. Names that are not in the table get a cautious guess from words like session or token, or are marked unknown. Treat every category as a guess.
What do Secure, HttpOnly and SameSite do?
Secure keeps a cookie to encrypted connections. HttpOnly stops scripts on the page from reading it, which protects sign-in cookies from theft. SameSite controls whether it is sent with requests from other sites, which helps against forged requests. Sign-in cookies should normally use all three.
Is this legal advice?
No. The scan is a guide to help you review your own site. Rules on cookies depend on where you and your visitors are and on what the cookies do, so check the requirements that apply to you or ask a qualified adviser before relying on the results.
Why does it flag analytics cookies set on the first response?
In the UK and many other places, cookies that are not strictly necessary normally need the visitor's consent before they are set. If one is already sent with the first response, before anyone has chosen, it is worth checking how your consent banner and tags are set up.
Does the scan send or accept cookies?
No. It sends no cookies and does not click through any banner, so a site that behaves differently for returning visitors or after consent may show different results in a real browser. Values of cookies are not shown, only their names and settings.