Cookie Checker

The tool opens the page and collects cookies from every redirect step, since redirects often set more cookies than the landing page itself. For each cookie you see its name, flags, lifetime, domain, and purpose. Well-known names like _ym_uid or _ga are labeled with the service they belong to.

The page source is read as well, to see which trackers and pixels it carries. This matters because a large share of cookies are set by scripts right in the browser, and never appear in the server response.

Three flags that decide how safe a cookie is

• Secure — the cookie is sent only over an encrypted connection. Without it, anyone on the same open Wi-Fi can intercept it;
• HttpOnly — scripts on the page cannot read the cookie. Without it, a third-party script can grab the session and log in as the visitor;
• SameSite — when the cookie is sent on cross-site requests. It limits forged requests from other sites.

A session cookie needs all three. A tracker cookie only needs SameSite, because it holds no secret.

Consent notices and data transfers

The check also looks for a consent request on the page, since visitors must be informed about data collection before it starts. If the consent banner is rendered by a script, it may be missing from the source, so check the page in the browser yourself.

Services that send data across borders, such as Google Analytics or Meta Pixel, are marked separately. Whether the required notification for such transfers has been filed is a question for a lawyer; the tool only shows which services are installed on the site.

Nearby you may find the HTTP headers check useful, where cookies appear alongside the rest of the response headers.