Script blocking
Tags wait for consent
Automatic cookie scanner
See the cookies your site sets.
Kukie.io opens your pages the way a visitor's browser does, records the cookies and storage they set and matches each against 3,300+ known cookies. Rescans keep the list current.
Why it matters
Your cookie list drifts as the site changes.
The list you write when you set up consent describes the site on that day. It goes wrong because websites change and cookie settings do not change with them.
-
Somebody adds a tag
A colleague adds a new pixel to the tag manager on a Tuesday afternoon. It works and it reports numbers. It also writes cookies that appear nowhere in your policy, and the person who added it had no reason to think about that.
-
A plugin updates itself
Themes, plugins and site builders ship new versions all the time, and a new version can use storage the previous one never did. That is how a site nobody edited can still end up setting something new.
-
An embed lands in one blog post
A video, a map or a social post goes into one article, months after launch. Checking the homepage will never reveal it, which is why a scan of many pages beats a spot check.
-
A third party changes its cookies
You do not control what an analytics provider, a chat widget or an ad platform writes into a visitor's browser. When they rename a cookie or add one, your site starts setting it without a line of your own code changing.
None of this is dramatic, which is part of the problem. Your cookie policy lists cookies you no longer set and says nothing about the ones you do, so the document meant to describe your site describes an earlier version of it.
What a scan looks at
A scan runs your pages, not your source.
Reading the HTML tells you which scripts a page asks for, not what they do once they run, and many cookies are written by JavaScript after the page loads. So Kukie.io opens your site.
-
Stage 1: Finds your pages
From your sitemap, or by following the links on your homepage.
-
Stage 2: Opens each one
In a real browser, so scripts run, embeds load and storage gets written.
-
Stage 3: Says yes to everything
Your Kukie.io banner lets the scan through as a visitor who accepted all, so cookies set after consent show up too.
-
Stage 4: Records what it finds
Cookies, localStorage, sessionStorage and embeds, with the domain that set each cookie.
-
Stage 5: Proposes categories
Every name is matched against 3,300+ known cookies.
Scan specification
- How each page is opened
- Loaded and run the way a visitor's browser runs it, not read as static HTML.
- What gets recorded
- Cookies, localStorage entries and sessionStorage entries, in one list. Tracking that has moved out of cookies is still tracking.
- What a scan can reach
- Nothing the scanner sees is filtered out, up to your plan's page limit. Pages behind a sign-in are out of its reach.
- While it runs
- Progress updates in real time, so you can watch the pages being worked through.
- Afterwards
- The run joins your scan history, which keeps every run from the last 30 days and always the 5 most recent.
- Your own consent cookie
- The cookie your Kukie.io banner stores the visitor's answer in is listed too, as Essential, so your policy can name it.
By hand or on a schedule
A spot check covers one day.
You can check by hand: open your site and the browser's developer tools, read the storage panels and write the list down. For a 5-page site it may be all you need.
Scan history
| What you want to know | Checking by hand | Automatic cookie scanning |
|---|---|---|
| Which pages get looked at | The ones you remember to open, which in practice means the homepage and maybe the checkout | The pages the scan reaches, every time it runs, including the ones you have forgotten exist |
| Which storage types | Cookies are easy to find, but localStorage and sessionStorage sit in separate panels people forget to open | Cookies, localStorage and sessionStorage recorded together as one list |
| What each cookie is for | You search the name and take your best guess from a forum post | Matched against 3,300+ known cookies, with a category proposed for you to confirm |
| Cookies with a unique suffix | Look like one-offs nobody has documented, because the identifier in the name is yours alone | Recognised as variants of a known cookie, so they still arrive categorised |
| Keeping it current | Needs you to remember, at some point in the future, that it has to be done again | Runs weekly or monthly on its own on the Pro, Agency and Unlimited plans, or on demand when you know something changed |
| A record of what it looked like before | Whatever notes you kept, wherever you kept them | Scan history: every run from the last 30 days, and the 5 most recent |
Checking by hand is a reasonable way to start, and worth doing once so you understand what your own site sets. The case for automating it is not that a person cannot do it. It is that a person will not do it every week for 2 years.
Categories
Each cookie is matched to a category.
Finding a cookie is the easy half. A cookie called _gcl_au means nothing to a site owner until someone says which category it belongs in, and a consent banner can only act on categories.
-
Step 1: The name is matched against known cookies
Kukie.io keeps a database of 3,300+ cookies that have already been identified: what sets them, what they are for and which consent category they belong in. Most of what a scan finds on an ordinary website is in there.
-
Step 2: Names unique to your site still match
Many cookies carry an identifier unique to your installation. Kukie.io recognises these variants and matches them to the known cookie they are, so they arrive categorised like the rest.
-
Step 3: Whatever is left comes to you
Cookies the database does not recognise are listed as uncategorised and wait for your decision. You also have the final say on the ones categorised for you, and the next scan does not overwrite it.
-
Step 4: Your decisions help other sites
When you categorise an unrecognised cookie, your organisation's choice counts as a vote. Once at least 2 organisations agree on a category, scans on other sites can propose it too. Essential is never proposed this way.
More than cookies
One scan, three more answers.
The same visit to each page tells you which embeds need consent, which pages your banner is missing from and which companies sit behind your cookies.
-
Embeds
Embeds become services
A map or a video can track visitors without a cookie the scan would see. The scan lists the embeds on each page, and the ones Kukie.io recognises are added as services iFrame blocking holds until consent.
-
Coverage
Pages missing your banner
A landing page built outside your theme or an old template can load without the banner. The scan lists every page it reached without your script, and leaves out the pages you have chosen to show no banner on.
-
Providers
The companies behind them
Cookies and scripts are grouped by the company that runs them, with what each one is for and links to its privacy policy, from a list of 245 providers.
Automatic and yours
The mechanical work runs without you.
Automatic should mean the repetitive work disappears, not that decisions get made for you without telling you. This is how the work is divided.
Kukie.io
Happens without you
- The rescan. Weekly or monthly, on the schedule you choose, with no reminder to set. Scheduled scans are on the Pro, Agency and Unlimited plans.
- Opening each page. The way a visitor would, letting the scripts run and recording the cookies and storage that result.
- Matching each name. Against the known-cookie database, with a category proposed for everything it recognises.
- Keeping the run. In your scan history, so the site's cookie list has a past as well as a present.
You
Stays your decision
- How often it runs. Set per site, because a site that changes weekly and one that changes yearly need different schedules.
- Where an unrecognised cookie belongs. The scanner will not invent an answer it does not have.
- Whether a proposed category fits your site. A cookie that is functional on one site can do something else on another.
- What to do about a cookie you did not expect. Finding it is the scanner's job. Deciding whether it should be there at all is yours.
Where results go
Results feed the rest of your setup.
A scan report you read once and close has saved you nothing. The results feed the things that have to stay accurate, so a current scan keeps them current.
Your site's cookie list
Every cookie, localStorage and sessionStorage entry the scan found, each in a category you can change. Your banner reads from this list.
Your cookie policy
The cookie policy generator fills its cookie tables from what the scan found, so the policy describes your site, not a template.
Your script settings
Results appear in Cookies & Scripts, where you tie each third-party script to its consent category.
Your iFrame blocking
Embeds the scan finds, such as a YouTube video or a Google Maps embed, are added as services iFrame blocking holds until consent.
Try a scan before you sign up
The free cookie scanner checks up to 10 pages of any site, with no account and no card. It is the fastest way to find out what you are dealing with. It does not come back next month, remember the categories you chose or feed your cookie policy: that is the difference between a one-off look and automatic scanning.
Scanning is included on every plan. How many pages a scan covers, and whether it runs on a schedule, depend on your plan.
When it matters most
Where a schedule helps most.
A single static page you built yourself and never touch is fine with one check by hand. These are the situations where a site changes often enough for a schedule to be worth it.
More than one person can add scripts
Once a tag manager exists, or a marketing team has access, your cookie list is more than one person can keep in their head. A schedule shows you what was added without anyone having to remember to tell you.
You run WordPress, WooCommerce or a site builder
Plugin and theme updates change what a site stores without touching your content. The WooCommerce page covers the shop side.
You look after sites for clients
Checking 20 client sites by hand every quarter is a job everybody postpones. A schedule for each site turns it into something that reports to you.
Somebody may ask you to justify the list
A customer, a partner's security review or a regulator's enquiry all end with the same question: how do you know that is what your site sets? Scan history is a dated answer, not a recollection.
Questions about cookie scanning
What is automatic cookie scanning?
Automatic cookie scanning loads your own website in a browser, whenever you ask or on a schedule, and records every cookie and browser storage entry that gets set. Instead of you reading developer tools by hand, a scanner opens your pages, writes down what it finds and compares it with a database of cookies it already recognises, so most entries arrive with a category proposed.
How often should I rescan my website for cookies?
It depends on how often the site changes. A brochure site that nobody touches for months can be rescanned monthly. A site where marketing adds tags, or where plugins and themes update themselves, is better on a weekly schedule. On the Pro, Agency and Unlimited plans, you can set each site to rescan weekly or monthly. On any plan you can run a scan whenever you know something has changed.
Does a cookie scanner find localStorage and sessionStorage too?
The Kukie.io scanner records localStorage and sessionStorage entries alongside cookies. This matters because much tracking has moved out of cookies and into browser storage, and a check that only looks at cookies will report a clean site while identifiers sit in localStorage. They appear in the same results as cookies, so you work from one list.
What happens when the scanner finds a cookie it does not recognise?
It is listed as uncategorised and waits for you. You decide which category it belongs in, and the next scan does not overwrite that decision. Your choice also counts as your organisation's vote in the shared cookie database: once at least 2 organisations agree on a category, scans on other sites can propose it too.
Do I need an account to scan a website for cookies?
Not to try it. The free Kukie.io cookie scanner checks up to 10 pages of any site with no sign-up, which is enough to see what a site sets today. An account adds a stored scan history, categories that survive the next scan and results that feed your cookie policy. Scheduled rescans are on the Pro, Agency and Unlimited plans.
Is scanning cookies the same as blocking them?
Scanning and blocking are different jobs. Scanning is a survey: it tells you what your site sets. Blocking is enforcement: it holds trackers back until a visitor has agreed. The categories a scan assigns fill the cookie list in your banner and your cookie policy, and decide which cookies are cleared when a visitor refuses. Which scripts wait for consent is set by script blocking, not by the scan.
Find out what your site sets.
Every plan can scan your site, and scan it again whenever it changes. The results feed the cookie list in your banner and your cookie policy.
Related features
Scanning tells you what is there. These are the features that act on what it finds.
-
-
Legal documents
Cookie and privacy policies
-
Analytics
Consent rates and records
More on auditing cookies
Practical guides to finding, categorising and keeping track of the cookies your site sets.
-
How to find out what cookies your website uses
Browser developer tools show the cookies on one page, a scanner covers many pages, the Network panel shows when each cookie is set, and loca...
-
How to Conduct a Cookie Audit: A Step-by-Step Methodology
A cookie audit identifies every cookie and tracking technology on your website, categorises each one by purpose, and documents whether conse...
-
Scheduled Cookie Scans: Why a One-Off Audit Is Never Enough
A single cookie scan tells you what your site sets right now. Scheduled scans tell you what changed since last time - new third-party script...
-
How to categorise cookies on your website, one test at a time
Categorise a cookie by what breaks when you remove it: the site, a setting the visitor chose, your own usage data or ads elsewhere. In a 202...
Disclaimer
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
