Cookie scanner

The GetFluxly cookie scanner is a free website cookie scanner you run straight from your browser, with no signup and no account. Paste in a URL and a real automated browser visits the site, finds the consent banner, clicks accept all on purpose, and reports every cookie, every storage key, and every tracker it can see, along with which of them loaded before anyone agreed to anything.

Run a scan on any public URL. It is free, and there is nothing to install.

Point it at your own site to check what your tag manager and embeds actually do in a visitor's browser, or point it at a competitor to see the trackers they load. A real browser does the sniffing, the good dog behind the tool, not a quick script that only reads your HTML. That difference matters: scripts, pixels, and consent banners run real code, and the only honest way to see what they set is to let them run.

How a scan works

You give the scanner one URL. From there it visits up to five pages of the same site, starting at the page you gave it and following internal links. On each page it does the same thing a careful auditor would:

1. Load the page in a real automated browser and record everything that lands: cookies, localStorage, sessionStorage, and the network requests the page makes.
2. Find the consent banner and deliberately click accept all.
3. Record everything again, then diff the before state against the after state.

Clicking accept all on purpose is the point, not a shortcut. Plenty of tools ask a banner nicely and report only what a cautious visitor would see. That hides the trackers that fire the instant the page loads, before the banner is even on screen. By capturing the browser state before the click, the scanner catches those early trackers with nowhere to hide, and by capturing it after the click it shows the full picture of what the site loads once a visitor says yes. The gap between the two is where the interesting findings live.

What the report contains

Every scan produces one report. In short, it covers:

• Cookies, with name, domain, first or third party, category, vendor, lifetime, size, the HttpOnly / Secure / SameSite flags, and a flag for anything set before consent.
• Browser storage, the localStorage and sessionStorage keys, classified the same way as cookies.
• Tracking technologies, a plain inventory of tools like Google Analytics 4, Meta Pixel, or Hotjar, each with the evidence that identified it.
• Third-party domains the site contacted, with request counts and matches against known trackers.
• Findings, a list sorted by severity, from serious issues down to things worth a glance.

The report guide walks through every field so you know exactly what each number and column means.

Scan limits and caching

The scanner is a shared free tool, so it works within some limits. None of them need signup, and the tool always tells you when one applies.

• Five pages per scan. It starts at your URL and follows internal links up to five pages total.
• Up to five minutes. A real browser takes real time to load five pages and wait for late scripts, so a scan is not instant.
• A 24 hour cache. Each scanned page is cached for about a day. Query strings are ignored, so the same page returns the same cached report, instantly, with a "scanned N hours ago" note. Scan a page a second time inside that window and you get the saved report rather than a fresh crawl.
• Rate limits. There is a per-visitor request limit, a per-domain daily cap, and a global daily scan budget for the whole tool. When any of these is reached, the scanner says so plainly, and cached reports still serve even while new scans are paused.

When a scan fails or looks empty

A scan can come back thin or fail outright, and the reason matters, so read the report notes before you draw a conclusion.

• The site never loaded. If the page times out or refuses to respond, the scan fails and says so. Nothing was measured.
• The scan was blocked. Bot protection, such as a Cloudflare challenge, can stop the scanner's browser at the door. This shows up as a suspiciously empty report on a site that clearly should have cookies. That is a blocked scan, not a clean site. An empty report on a big commercial site almost always means the scanner never got in, not that the site sets nothing.
• One region only. The scanner runs from a single region. Consent banners are often geo-targeted, so a site may show a different banner, or none, to visitors elsewhere. What you see is what a visitor in the scanner's region would see, which may not match your own location.

Not legal advice

Note: the report is informational, not legal advice. It tells you what a site loads in a browser and flags patterns that often matter for privacy law, but it does not decide whether a site is compliant. For compliance decisions, talk to a qualified professional.

Keep reading

• Reading your cookie report, a field by field guide to the results.
• Cookies set before consent, the finding that matters most and how to fix it.
• First-party vs third-party cookies, what the party label means and why it is changing.