Enter a domain and MostlyPrivacy crawls a few of its pages, lists the cookies your server sets and the third-party services your pages call, and sorts each into a consent category.
The scanner fetches your home page and follows links to a few more pages on the same site — 3 on the free plan, and up to 10, 25 or 50 on Starter, Pro and Agency. On each page it reads the cookies your server sets in its responses and the third-party hosts your HTML loads scripts, images, frames and stylesheets from.
Each finding is matched against a database of common services — analytics, advertising, payments, support chat, fonts, video embeds — and labelled with its provider, purpose, country and consent category. Cookies your own server sets are marked first-party; everything else is attributed to the service that sets it.
You get an inventory, not a verdict: what loads, who runs it and whether it normally needs consent. That is the list you need before you configure a banner or write a cookie policy.
The scanner uses the same four categories as the MostlyPrivacy banner and cookie policy.
Needed for something the visitor asked for — a session, a basket, a security check. No consent needed, but you should still disclose them.
Measure how the site is used. In the EU and UK these normally need consent unless the tool sets no cookies at all.
Advertising, retargeting and social embeds. Opt-in in the EU and UK; in California, covered by the right to opt out of sale or sharing.
Remember choices such as language or a support-chat session. Usually need consent unless strictly necessary.
Services that work without setting cookies are marked exempt, so they don't need to sit behind the banner.
A third-party cookie the database doesn't recognise is treated as needing consent — the safe default until you know what it does.
Start with anything marked as needing consent. Each of those scripts should load only after the visitor agrees: add the MostlyPrivacy banner and tag the scripts with the category the scanner shows. Then describe the same categories in your cookie policy, and list the services in your privacy policy where they process personal data.
Scan again whenever you add a tool, a pixel or an embed. On paid plans you can schedule daily, weekly or monthly scans for a site once you have verified you control its domain.
The scanner does not run your site's JavaScript. Cookies written by scripts in the browser, local storage and services loaded dynamically by a tag manager will not appear, and neither will pages behind a login. Treat the result as a floor — what is certainly there — and check your tag manager for the rest.
Classification is based on known services and cookie names, so it can be wrong for custom or unusual tools. Scans of domains you have not verified are rate-limited. The scanner tells you what loads; whether your site complies depends on how you handle it.
Next steps: Cookie consent banner · Cookie policy generator · Privacy policy generator
Yes. Create a free account and you can scan a site, up to 3 pages per scan. Paid plans scan more pages — 10 on Starter, 25 on Pro and 50 on Agency — and add scheduled scans.
Cookies your server sets in its responses, and the third-party services your pages load scripts, images, frames and stylesheets from. Each is matched to a known service and given a consent category.
The scanner does not execute JavaScript, so cookies created by scripts in the browser, local storage and anything a tag manager loads later are not captured. Check your tag manager for those.
A scan crawls a real website, so we tie it to an account and limit scans of domains you have not verified. Signed out, the page shows a sample report so you can see what the output looks like.
In the EU and UK, anything that is not strictly necessary for a service the visitor asked for — typically analytics, advertising and many embeds. In California, advertising cookies fall under the right to opt out of sale or sharing.
Into necessary, analytics, marketing and preferences — the same categories the MostlyPrivacy banner and cookie policy use. Unrecognised third-party cookies are treated as needing consent.
Yes, on paid plans. You can scan a site daily, weekly or monthly once you have verified that you control its domain.
No. A scan shows what loads; compliance also depends on how consent is collected, which scripts wait for it and what your policies say.