Secure Privacy's website scanner automatically detects cookies, trackers, and third-party services running on your site, classifying each into a consent category and generating a compliance score. This guide explains how to run manual scans, where to configure your scan settings, how to read your results, and how to automate recurring scans so your cookie declarations stay accurate over time.
Who Is This For?
Website administrators running and configuring Secure Privacy scans for their domains
Compliance teams reviewing scan results, cookie inventories, and compliance scores
Developers automating recurring scans and allowlisting the scanner in firewalls or WAFs
How the Secure Privacy Scanner Works
The scanner visits your website pages like a real browser, executing JavaScript, loading resources, and cataloging everything it finds:
First-party cookies set by your domain
Third-party cookies set by external services such as analytics tools, ad networks, and social widgets
Local storage and session storage entries
Tracking pixels and beacon requests
Third-party scripts loaded on your pages
Each detected item is automatically classified into a consent category: Essential, Analytics, Marketing, Preferences, or Social Media.
How to Run a Manual Scan
Before you start
Ensure your domain is added to the Secure Privacy dashboard and the installation script is active on your site before running a scan.
Steps
Log in to your Secure Privacy dashboard.
Open the Domains section and select the domain you want to scan.
Under Reports, click Scan Report.
Click Rescan Website.
Wait for the scan to finish. Most scans complete within a few minutes, though larger sites and sites with many third-party scripts take longer.
Tip: After making significant changes to your website, such as adding new marketing tags, integrating a new analytics provider, or redesigning pages, always run a manual scan to catch newly introduced cookies.
Configuring Scan Settings
All scan options for a domain live in one place. From the dashboard, go to Domains, select your domain, then open Reports > Scan Report and click the Settings tab. Click Save at the top of the page to apply any change, then run a rescan if you want the new settings reflected straight away.
Setting | What It Controls | Options |
|---|---|---|
Scan Location | The country the scanner browses your site from | United States (default) or European Union (Germany) |
Scan Frequency | How often automated scans run | Monthly or Manual |
Send Report via Email | Automatic delivery of each completed compliance report | On or off |
Include or Exclude Pages | Which URLs are always scanned, and which are skipped | Comma-separated URL list |
Scan Behind Login | Access to authenticated pages and member areas | Advanced and Enterprise plans |
For a full walkthrough of every option, including scan location and authenticated scanning, see how to configure Scan Report settings in Secure Privacy.
Pages to scan
The scanner discovers pages on your site automatically. You can steer that coverage from the Include or Exclude Pages from Scanning section of the Settings tab:
Include list: URLs the scanner should always check. Useful for key compliance pages such as checkout, pricing, or contact pages that the crawler may not reach on its own.
Exclude list: URLs to skip, for example
/admin/or/staging/, or any area outside your compliance reporting scope.
Enter multiple URLs as a comma-separated list, click Save, then return to the Scan Report tab and run a rescan to apply the new page list. See how to include or exclude pages from scanning for a step-by-step guide.
How scan coverage is determined
Secure Privacy does not use crawl depth levels, so there is no depth or crawl-level setting to choose in the dashboard. Page coverage is shaped by three things instead: automatic page discovery, your Include and Exclude lists, and Scan Behind Login for authenticated areas on Advanced and Enterprise plans. If a page is missing from your results, check that it has not been excluded and that it loads publicly from your selected scan location.
Understanding Scan Results
Cookie inventory
After a scan completes, you will see a detailed cookie inventory showing the following fields for each detected item:
Field | What It Shows |
|---|---|
Name | The cookie identifier |
Domain | Which domain sets the cookie |
Category | Auto-assigned consent category |
Duration | How long the cookie persists |
Description | What the cookie is used for |
Compliance score
Your compliance score is calculated based on four factors:
Categorization completeness: Are all detected cookies properly categorized?
Essential cookie accuracy: Are essential cookies correctly identified and marked?
Pre-consent blocking: Are non-essential cookies blocked before visitor consent is given?
Declaration accuracy: Does your published cookie declaration match what the scanner detected?
Setting Up Automatic Scheduled Scans
Automated scanning catches new cookies introduced by site updates without requiring manual intervention, keeping your cookie declarations current between planned reviews.
Open Reports > Scan Report for your domain and click the Settings tab.
Set Scan Frequency to Monthly for automated recurring scans, or leave it on Manual if you prefer to trigger every scan yourself.
Enable Send Report via Email to have each completed compliance report delivered to the email address on your Secure Privacy account.
Click Save to apply your settings.
Recommendation: Monthly automated scanning suits most organisations. Pair it with a manual rescan after any change that could introduce new trackers, such as installing a plugin, launching a campaign landing page, or adding a new advertising pixel.
Allowlisting the Secure Privacy Scanner
If your website is protected by a firewall, CDN, or WAF, the scanner may be challenged or blocked, resulting in incomplete scan results. Contact [email protected] to request the current list of scanner IP addresses to allowlist in your security configuration.
Post-Scan Checklist
After every scan, review the following to maintain an accurate and compliant cookie configuration:
Assign categories to any unclassified cookies detected in the inventory.
Update cookie descriptions for accuracy and visitor transparency.
Verify that essential cookies are correctly marked and no non-essential cookies are in the Essential category.
Confirm that marketing and analytics cookies are blocked until consent is given.
Update your published cookie policy to reflect any new cookies or services found in the scan.
Frequently Asked Questions
How often should I run a website scan?
Monthly automated scanning is recommended for most websites. Set Scan Frequency to Monthly in your Scan Report settings, then trigger a manual rescan whenever you make significant changes, such as adding new marketing tags, installing plugins, updating your CMS, or integrating new analytics or advertising services, to catch newly introduced cookies immediately.
Where do I configure scan depth in Secure Privacy?
There is no scan depth or crawl-level setting to configure. Secure Privacy discovers pages on your site automatically, and you control coverage through the Include and Exclude lists in Reports > Scan Report > Settings, plus Scan Behind Login for authenticated pages on Advanced and Enterprise plans.
Should I scan my website from the US or the EU?
Scan from the location that matches your compliance obligation. Many ad networks and third-party scripts serve different cookies to European visitors, so a US-origin scan can under-report what GDPR-regulated users actually receive. If GDPR applies to your site, set Scan Location to European Union (Germany). The default is United States.
What does it mean if a cookie is marked as "unclassified"?
An unclassified cookie is one that Secure Privacy's automatic classification engine was unable to match to a known service in its database. Review unclassified cookies manually, identify what service or script is setting them, and assign the correct consent category in the Classification tab. Unclassified cookies can affect your compliance score and may not be correctly blocked until categorized.
Why might the scanner not detect all cookies on my site?
The scanner may miss cookies that are only set after specific user interactions, sit behind authentication, or live on pages it cannot discover automatically. Use the Include list to add any critical pages manually, and use the Scan Behind Login feature on Advanced and Enterprise plans if authenticated pages need to be scanned.