Cookies

The screen has three parts: Find what your site stores (the tools that fill the table), Verdict (one sentence) and What your site stores (the table). After a scan, a fourth part follows the table: Your fonts.

Next to Scan my pages, the screen says “Opens up to 30 of your pages, like a visitor.” The folded How does it work? explains the same in a few lines. During the scan, a counter and, since 2.9.14, a progress bar show the pages done. Your browser opens your pages three at a time, as a first-time visitor, with no cookie of yours. At the end, a message says “Analysis done: 28 pages examined.” (with your number).

• The pages: your home page, up to 15 menu items, the latest post of each public type and its archive, a category, the shop, cart, checkout and account pages of WooCommerce, your privacy and cookie policy pages, up to 10 recent pages, posts and products whose content holds a frame, a script or a YouTube address, then recent pages. Since 2.9.8, menu links to unpublished pages and lists of a post type with nothing published are skipped, and a page that redirects elsewhere is not counted as unread: the screen says “… redirects to …: not scanned.”
• On up to 6 of them (your home page first, then the pages where trackers were found), the scan watches what is stored before the visitor makes any choice, whatever cookie banner your site uses.
• It also reads the buttons of your current banner on the home page, what each plugin adds to the home page (see Weight), and your Google Tag Manager container, if your site has one.

Nothing changes for your visitors. The scan cannot see what appears only after a visitor does something: signs in, pays, switches language. The screen says so: “Some cookies appear only after a click, a sign-in or a payment. Cookie Rocks Pro can record a visit to find them.”

The Overview reminds you when the last scan is more than 25 days old.

Under Options, two boxes are ticked by default:

• Include browser storage (local storage, session storage, IndexedDB). The law covers everything a site stores or reads on the visitor’s device, cookies or not, in the European Union, the EEA and the United Kingdom. If you untick it, the scan and your cookie policy leave browser storage aside.
• Also read the code of your theme and plugins. Cookie Rocks looks in the files of your active theme and plugins for the names of the cookies and stored items they write. It finds names the scan cannot see, such as a cookie set only after a sign-in. Only names written in full are found. The reading stops after 15 seconds. Nothing leaves your site.

• “No page of the site could be read: it may be protected by a password, in maintenance, blocked by a firewall, or served by a cache that ignores the analysis. The previous analysis is kept.” Remove the obstacle, then scan again.
• “The analysis stopped. Try again.” Something went wrong in your browser or on the server. Click Scan my pages again. Since 2.9.14, the screen adds advice: “If it stops again, check that your pages open, then ask your host to raise the PHP time limit (max_execution_time) and memory (memory_limit), or pause a security plugin that limits requests.”
• “Updated or changed banner since this scan? Scan again to see the site as it is now.” The last scan was made before an update of Cookie Rocks, or with another banner. Click Scan my pages.
• “3 pages could not be read: their cookies may be missing.” This note sits at the top of the screen. Unfold it to see the pages.
• “No cookie or stored item found on the pages scanned.” The scan ran and found nothing to list.

Tools added through Google Tag Manager do not show in your pages. When the scan sees a container on your site, or when Site Kit or GTM4WP names one in its settings, a row appears under the scan. Cookie Rocks reads the public file of the container once a day and after each scan, and lists the tools it loads. Read my Tag Manager reads it at once.

• “Container GTM-XXXX read on …”, then each tool found, marked Declared or To declare.
• “not read yet.” or “could not be read. Try again later.”: no reading to show.
• “No service from the catalogue.”: the container loads nothing Cookie Rocks knows.
• “1 paused tag, not counted: it does not run.” Paused tags are never declared.

A tool found in the container for the first time is declared by itself, with a message under News and alerts on the Overview. Declare what it loads declares the others. Their cookies then appear in your cookie policy.

One sentence sums up the cookies that need consent and that the scan could check:

• “Nothing that needs consent loads before the visitor chooses, on the 28 pages scanned.”
• Some trackers load before the visitor chooses: the sentence names them, for example “(2 of the 5 that need consent)”.
• “Nothing waits for consent”: every one of them loads before the visitor chooses.
• “Not checked yet.”: the table is empty. Start with Scan my pages.

The verdict carries a label: Done in green, Alert in red, To do while nothing is checked. When something loads too early, the verdict is red and adds: “Your cookie banner lets them through. Check its settings, or how they are added to your site.” With no banner recognised: “No cookie banner holds them back: add one that asks first.”

Under the verdict: the number of lines to check, and the date of each check, for example “Checked: scan on [date] (28 pages) · Tag Manager read on [date] · code read on [date] · known cookies from Cookie Rocks [version].” When the code reading did not finish, it adds “(stopped after 15 seconds: some files were not read)”.

A last line says from where the pages were seen: “Pages opened from your browser, as a visitor in … sees them.” Your browser runs the scan, so it sees the banner of your own country. A cookie banner that changes with the visitor’s country may look different to visitors elsewhere.

One table, with one line per tool, cookie or stored item. What is not in order comes first. Above the table, the links All, Not in order and To check filter the lines, each with its number. On a phone, each line becomes a card.

Expand Pages analysed, under the table, to see each page scanned and the tools found on it.

Cookie Rocks knows the cookies of 675 tools, such as Google Analytics, the Meta pixel, YouTube or Hotjar. For each one found, the column Before the visitor chooses reads:

• Blocked: it waited for the visitor’s choice. In order.
• Allowed (necessary): a tool needed for the site to work, such as payment or security. It needs no consent.
• Not blocked: it loaded, or set its cookies, before the visitor chose. Not in order. The line names what was seen before consent.
• Not watched by the scan: the tool was not on the pages where the scan watches what loads before the choice. Not checked. A tool declared from your Google Tag Manager container reads the same, since it does not show in your pages.
• Not checked yet: no scan yet.

The Google tag (gtag.js) can carry Google Analytics and Google Ads. When a page carries a Google Ads conversion ID (AW-…), Google Ads is listed too. When you answer No Google Ads on the Google screen, or when Site Kit is active without its Ads module, and nothing else shows Google Ads on your site, the tag is listed as “Google Analytics (gtag.js)”, with statistics cookies only. Otherwise it stays “Google Analytics / Google Ads (gtag.js)”, to be safe.

Besides cookies, sites keep data in the browser: local storage, session storage and browser databases (IndexedDB). Cookie Rocks knows 494 storage keys. Deleting cookies does not remove this data. The Overview shows a serious alert when an advertising identifier is stored in the browser before the visitor consents.

Some cookies and keys belong to no known tool: your theme or your plugins set them. They are listed with where they were seen, for example “Set by the server on 3 pages”, their duration, and what they probably are. The cookie in which your current banner keeps the visitor’s choice is recognised as necessary. With the Audit, the scan sees them before any choice, so they read:

• Probably necessary: Allowed (necessary). When its value looks like an identifier, it is marked To check: check that it is really necessary.
• Not necessary: Not blocked, not in order.
• Unknown: Not blocked, To check. Find out what it is for.
• Found only in the code: Not seen on your pages, with the verdict Not checked. It may be set after a visitor action, or only for the site team. These lines are folded at the end, under Found only in the code.

When visitors can sign in, a line Sign-in to this site lists the sign-in cookies of WordPress: necessary, set after sign-in only. Your cookie policy should name every cookie and key that is not strictly necessary.

With the Audit, the table lists your site’s own items and suggests a category. It does not classify them, and it does not delete them.

The Your fonts section lists the fonts your pages load from another site before any choice: Google Fonts, Adobe Fonts, Bunny Fonts, Font Awesome, Fontshare, Monotype and any other font file. That site receives visitors’ IP addresses. For each one, you see the families really loaded and what its licence allows, and the section says how many pages it relies on. Fonts served from your site, and fonts loaded after consent by a tool that waits for it, are listed apart.

Cookie Rocks does not hold fonts until consent: your pages would lose their look.

Scripts and frames from other sites that Cookie Rocks does not recognise have a line Unrecognized cookie, with their address, or Image from another site or Font from another site for those files. The line says how to check: read the address, which often names the company, then search for that name or ask whoever built your site. They load without waiting for consent, so they are marked To check. Many are harmless: fonts, payment, booking. Scripts from WordPress.org and the jsDelivr, cdnjs and unpkg libraries are left out. Since 2.9.13, the list is the one of the last scan: an address the scan no longer sees leaves it.

The scan opens your pages in a preview, as a visitor who has not chosen yet. Since 2.9.13, if a plugin of your site reads WP Consent API, your own consent as administrator is set to “deny” for the time of the scan, then put back. Some plugins loaded their tools in the preview because of it, and the scan reported them as loaded before consent.

Why it matters. An unknown script is not held, so it can run before the visitor chooses, and your cookie policy does not name it. Each line gives you three ways to settle it:

• Send to Cookie Rocks sends the address of this service and the plugin version to Cookie Rocks, when you click. Nothing about your visitors is sent, and the address of your site is not sent either. The line then says “Sent. Thank you.” If the sending fails, it offers the form on cookierocks.com.
• Hold until consent, with Cookie Rocks Pro: give the service a name, if you know it, and a category. Cookie Rocks then holds it like a tool of its catalogue, and the cookie policy changes. Undo releases it.
• Not a tracker removes the line. Under the table, one click brings it back.

What happens after you send one. Sending changes nothing on your site: the script keeps loading as before. We read the address, and when we can identify the tool, we add it to the catalogue. Every site then recognises it through the list of known cookies: Cookie Rocks Pro holds it until consent, and it is named in the banner and the cookie policy. To hold it today, without waiting, use Hold until consent. We cannot reply to a report, because it does not say who sent it.

• A third box under Options, Also list the cookies set once everything is accepted, shows and is ticked while the banner is on and the key is valid. Cookie Rocks opens up to 3 of your pages in your browser, accepts everything for this test only (no consent is recorded), notes the cookies they set, then deletes them and puts your own choice back. These test visits may show in your statistics. Cookies set on another website, such as youtube.com, cannot be seen from your site. Items of your site seen only then read Only when needed if they are necessary, otherwise Not set before the choice.
• In Before the visitor chooses, a known tool can also read Loads, follows the choice (it receives the visitor’s choice, such as Google tags with Consent Mode), Through Tag Manager, or Allowed (exempt measurement) when audience measurement without consent is on (see Consent).
• Record a visit: your home page opens, and you browse your site for a few minutes as a visitor would (language, currency, light or dark mode, a poll, cart and checkout, sign-in). Click Stop in the bar at the bottom of the page when you are done. Without it, the recording stops by itself after 30 minutes. Each cookie and stored item you trigger is added to the table. Only names are kept, never values.
• Each item of your site gets a Category menu and a field What it is for (optional). An item already recognised or classified shows Recognised or Classified, with these fields folded under Change. A suggested category says “Suggested. Save to confirm.” Click Save Changes. Classified items appear in your cookie policy. Those that are not necessary are deleted from the browser until their category is accepted: the line then reads Deleted until consent. Since 2.9.8, a key written only by scripts that no visitor page loads is filed under Site team only: not for visitors, it is left out of the cookie policy.
• A cookie the browser cannot delete is marked “Protected (HttpOnly)”. If it is not necessary, adjust the plugin that sets it.
• The last line, Add a cookie or a key, declares by hand what the tools cannot see, such as a cookie set only after a payment, a sign-in or a click. Which category? gives examples.
• A tool loaded through Google Tag Manager reads “Declared by you: loaded through Google Tag Manager.” Edit the list lets you tick a tool Cookie Rocks did not find, or untick one: your choice is kept. Declared tools appear in the cookie policy and the details of the banner.
• Between scans, Cookie Rocks notes the tools it recognises when visitors open your pages. While the banner is off, Scan my pages is disabled: “Turn the banner on to analyse the site.”
• A tracker that still loads too early is loaded by something that bypasses the blocking, often a theme option, another plugin or code added by hand. The verdict says so. Add it through its usual tag or plugin, or give its code the attributes described on the Developers pages.
• Without a valid key, classifying is locked.