Free cookie-consent check
Does your website set tracking cookies before visitors agree?
Find out in about 30 seconds. We open your site in a real browser as a first-time visitor and show which cookies fire before consent. The report also covers the security basics: TLS, security headers and outdated libraries.
- Tracking cookies before consent
- Reject button on cookie banner
- Privacy policy present
- TLS certificate valid
- Outdated JavaScript libraries
Built for two kinds of teams
Monitor every client site from one place
Daily scans of up to 20 sites and PDF reports with your own logo. Add them to your maintenance package or sell them as a separate service.
For agencies →WooCommerce, PrestaShop, OpenCart
Themes and plugins often load analytics and ad pixels before the cookie banner is answered. Find out if yours does, and what to change.
For e-shops →Why cookies before consent matter
Under the ePrivacy Directive and GDPR, a website may set analytics or advertising cookies only after the visitor has actively agreed, and refusing must be as easy as accepting. The largest fines have gone to large companies, but the rule is the same for every site, and a visitor can file a complaint with the data protection authority about any of them.
Advertising cookies were set automatically when visitors arrived, before they agreed to anything.
Same finding: advertising cookies placed on arrival, without prior consent.
Accepting cookies took one click; refusing them took several. Refusal must be as easy as consent.
A pre-ticked checkbox is not valid consent. The rule applies to every website in the EU, not only large ones.
A real browser, like a first-time visitor
Headless Chromium loads your site without clicking anything and records cookies, the consent banner, headers and the certificate.
Clear priorities
Separate GDPR and security scores roll up into a single 0–100 grade, and every finding comes with a concrete fix.
Catch regressions
A plugin update can bring the problem back. We re-scan weekly on Starter and daily on Business and Agency, and email you only when something changes.
Simple, per-site pricing
Frequently asked questions
Is the free scan really free?
Yes. No account and no card. Enter a domain and an email address and we send the report by email, usually within minutes. To prevent abuse, each IP address can run three free scans per hour.
What do you check?
GDPR: tracking cookies set before consent, whether the cookie banner has a real reject option, whether a privacy policy is linked and reachable, and whether forms ask for consent. Security: TLS certificate and HTTPS redirect, security headers (HSTS, CSP, X-Frame-Options and others), outdated JavaScript libraries with known vulnerabilities, and exposed files.
How is it different from looking at the site myself?
Our scanner opens your site in a real browser as a first-time visitor who has not clicked anything, then records every cookie that appears. Tracking cookies set by a theme, plugin or tag manager before consent are easy to miss by eye, especially when you are already logged in or have clicked the banner before.
Can I scan a site that isn’t mine?
Only if you are authorised to — your own site, or a client site you manage. Some checks go beyond what an ordinary visitor sees, for example looking for exposed configuration files, so our Terms require that authorisation.
Does a good score mean my site is GDPR compliant?
No. We run technical checks and show what a browser can observe. Compliance also depends on things no scanner can see — your contracts, records and internal processes. The report is a technical starting point, not legal advice.
How is the score calculated?
GDPR issues can cost up to 60 points and security issues up to 40. Each finding deducts a fixed amount (for example, 25 points for tracking cookies before consent), and the result is shown as a 0–100 score with separate GDPR and security sub-scores.
Which platforms does it work with?
Any public website: WordPress and WooCommerce, PrestaShop, OpenCart, Shopify, Magento or a custom build. The scanner looks at what the browser receives, so it doesn’t need a plugin or access to your server.
What happens to my email address?
We use it once, to send the report you asked for. We keep the scan record for 12 months and then delete it automatically. Details are in our Privacy Policy.
Can I put my own logo on the reports?
Yes, on the Agency plan: your logo, company name, colour and footer on every PDF report, so you can hand them to clients as your own.
Who’s behind SecurityScan
SecurityScan is built in Latvia by web developers who build and maintain online shops and client websites for a living. We made it because we kept finding the same problems on client sites, most often a theme or plugin quietly loading tracking cookies before the cookie banner had been answered.
Operated by SIA "Villetta JZN", reg. no. 40203469914, Kazāru iela 4-34, Saurieši, Stopiņu pag., Ropažu nov., LV-2118, Latvia.