Cookie Scanner & Consent Audit

Install

Install BambooForge Cookie Scanner. Sixteen known third parties are created, and a monthly scan is scheduled for every website. Nothing is fetched until the first scan runs.

Menus: SEO Pro → Trackers Found, and under Configuration, Cookie Scans and Known Third Parties.

Running a scan

Configuration → Cookie Scans → New → Scan the site.

The scan fetches this website's own pages - the ones SEO Pro has indexed, at most sixty, one at a time, each with a twelve second timeout and a two megabyte cap. It never fetches another host: a scanner that can be pointed elsewhere is a proxy.

For each page it records:

• third parties, matched against the knowledge base;

• cookies your server set, read from the response headers.

The log lists the pages that failed and why, capped at fifty lines so it stays readable.

What it will not claim

It does not run JavaScript. That matters, and it is stated on every screen: it reports which vendor is present and which cookies that vendor is known to set - not that it observed them. Cookies from the response headers are labelled separately, because those really were observed.

That is the version of the report you can defend. A tool that shows a cookie list it inferred is a tool that will be wrong in a meeting.

The work list

SEO Pro → Trackers Found opens on Not declared: findings that Consent Pro has never been told about. A finding is treated as declared when a Consent Pro script has the same name, or contains one of the vendor's fingerprints in its URL, code or preset.

Declare in Consent Pro creates the entry with the vendor's category, so the banner and the register agree with the site. Ignore is for the ones you have decided about - a first-party analytics script, say.

The knowledge base

Configuration → Known Third Parties. A vendor is:

• a name, as it should appear in the banner;

• a category - essential, functional, analytics or marketing;

• patterns: comma-separated fragments to look for in the page source, usually a host or a script path;

• the cookies it is known to set, used to fill in a declaration;

• optionally a privacy policy URL and a note.

They are ordinary records. Add the one your agency uses; the next scan knows it.

Two notes worth reading:

• Google Fonts sets no cookie, and is listed anyway: the visitor's IP address reaches Google, which a German court has had an opinion about.

• Stripe is filed as essential because that is what it is on a checkout. If it is on every page of your site, that is the finding.

The monthly scan

Every website with Scan for undeclared trackers monthly on is scanned at 02:20, so a script somebody added in a hurry shows up in the report before it shows up in an audit. A website whose scan fails does not stop the others.

Support

support@bambooforge.dev - the people who wrote it.