How the scan works
The scanner opens your website in a real Chrome browser, the way a first-time visitor does, and records every cookie and localStorage entry your pages create.
Two passes
Section titled “Two passes”- Before consent. A fresh browser visits your pages without touching the banner. Everything set here was set before the visitor agreed. Cookies that are not necessary in this pass are a problem to fix: usually a tag that loads above the CookieDoo snippet or outside it.
- After consent. A second fresh browser selects Accept all in your CookieDoo banner and revisits the first five pages, to find the cookies that only appear once a visitor agrees. If the banner is not found (the snippet is missing, or the banner is off), this pass is skipped and the report says so.
The scanner identifies itself with CookieDooScanner/1.0 in its user agent. Its clicks on your banner are not stored in your consent log.
Which pages
Section titled “Which pages”- First the pages in your sitemap: the
Sitemap:lines ofrobots.txt, or/sitemap.xml. Sitemap indexes are followed too. - Then the links it finds on each page, on your own domain only.
- Addresses differing only by tracking parameters (
utm_*,fbclid,gclid) or by#…count as one page. Files such as PDFs and images are skipped. - Pages are taken one of each kind first: addresses are grouped by their first path segment (
/product/…,/blog/…), so the page limit covers every template instead of only the first products.
The number of pages depends on your plan: 100 (Free), 1,000 (Lite), 10,000 (Pro), 50,000 (Business).
| Plan | Automatic scan |
|---|---|
| Free | Every 30 days |
| Lite, Pro | Every 7 days |
| Business | Every day |
The first scan starts a few minutes after the domain is verified. Owners and Admins can also select Scan now on the domain’s Cookie scan page, at most once every 10 minutes.
New cookies between scans
Section titled “New cookies between scans”Cookies can appear between two scans, for example after you add a new plugin. About 2% of your visitors’ page views check the cookie and localStorage names in their browser against your cookie declaration. If a name is unknown, CookieDoo starts a new scan: at most once a day on paid plans and once a week on Free. Only names are sent, never values, and they are not stored.
Sorting the cookies
Section titled “Sorting the cookies”Each cookie found is matched to its provider and category from the CookieDoo cookie database, which builds on the Open Cookie Database and grows with every scan. Providers found on your site are added to your declaration automatically, so the banner and the cookie list stay current.
Cookies the database does not know yet are marked unclassified. Our team reviews them; once one is classified, your report and declaration update by themselves.
E-mails
Section titled “E-mails”Owners and Admins get an e-mail when a scan finds new cookies compared with the previous scan, or more non-necessary cookies before consent. A first scan only e-mails about cookies before consent.