Check Cookies on Website
Identify every cookie your site stores in a user's browser. Audit your dependencies and protect visitor data privacy.
Use this guide to understand the issue, validate the problem manually, and run the live scanner when you are ready. Get results in under 30 seconds.
Run the scanner for this issue
The fastest way to confirm this issue on a live domain is to run the dedicated scanner. It checks the technical signal directly, then shows the finding in plain language with remediation context.
Why teams search for this check
Search intent around this topic usually comes from one of three pressures: a buyer or procurement questionnaire, a legal or compliance review, or an engineering team trying to validate a risky browser behavior before launch.
This page is written to answer that intent directly, without generic filler. It explains what the issue means technically, how to confirm it manually, and what a defensible fix looks like in production.
The need for cookie transparency
Users expect and legally demand transparency regarding what data is stored on their hardware. When site owners check cookies, they map out the complete data collection footprint of their application.
This process often reveals forgotten, outdated, or undocumented third-party integrations that silently track users long after their original business purpose has expired.
Failing to document and classify active cookies exposes your business to regulatory fines. Furthermore, cookies that are missing Secure or HttpOnly flags pose significant session hijacking security risks. In practice, teams usually do not lose trust because of a single configuration detail. They lose trust when the issue suggests weak governance, undocumented vendors, avoidable data sharing, or a disconnect between legal claims and live technical behavior.
What this tool specifically detects
- Cookies placed by the page response that may be analytics-related, advertising-related, or security-sensitive.
- Long-lived identifiers and cookie attributes that change how regulators and security reviewers interpret risk.
- Cookie behavior that can require prior consent, updated notices, or tighter security controls.
When this becomes critical
- You use analytics, ad tech, or multi-vendor marketing stacks.
- The site contains login, checkout, or customer account flows.
- You are responding to GDPR or ePrivacy concerns from customers, procurement teams, or legal counsel.
How this check works
This tool inspects the incoming `Set-Cookie` directives from the server response, illuminating the names, domains, and security attributes of all active browser storage operations.
The goal is not to create noise. The goal is to surface the signal that matters first, show you how the issue normally appears in production, and help you decide whether you need a quick fix, a deeper audit, or a broader policy update.
Real-world examples that trigger this finding
A site drops _ga and _fbp on first load even though the cookie banner says tracking is optional.
An authentication cookie is missing Secure or SameSite, raising a preventable session-handling concern.
A legacy vendor leaves behind marketing cookies long after the integration was removed from the UI.
How to manually detect this issue
- Inspect Set-Cookie headers and the Application tab in browser DevTools after a fresh page load.
- Separate essential session cookies from analytics or advertising identifiers.
- Check whether cookie creation changes before and after the user interacts with the consent banner.
How to fix it
- Classify cookies by business purpose, duration, and origin.
- Block non-essential cookies until consent is collected and documented.
- Apply Secure, HttpOnly, and SameSite controls to sensitive cookies where appropriate.
- Retire unknown or obsolete cookies and update the cookie notice.
Common mistakes teams make
- Treating all first-party cookies as exempt from disclosure or consent.
- Ignoring cookie duration, which often reveals tracking intent.
- Leaving security attributes inconsistent across staging, production, and subdomains.
Related Tools and Guides
Frequently Asked Questions
What is an HttpOnly cookie?+
What does the Secure flag do on a cookie?+
What are zombie cookies?+
Can a user simply turn off cookies?+
What does a cookie banner need to include?+
Need a broader privacy review?
Run the full SitePrivacyScore audit when you need more than a single point-in-time check. It combines trackers, cookies, headers, consent signals, and remediation guidance in one report.
For deeper runtime checks, run the full privacy audit →