How it works
One fetch, two readings
Our server requests the page once, the way a browser asks for the first HTML, and follows up to three redirects. It does not run JavaScript, click a consent banner or open other pages.
Cookies come from the Set-Cookie headers of every response along the way. For each one you see its name, the scope it declares (Domain, Path), when it expires (session, or a date from Expires or Max-Age, where Max-Age wins), and its security attributes: Secure, HttpOnly, SameSite and Partitioned. Values are never shown.
Tracker signatures
The HTML is matched against our own list of about fifty signatures: the script address, global function or ID pattern each vendor's install snippet uses (for example googletagmanager.com/gtm.js with a GTM- container ID, or fbq('init', …) for the Meta Pixel). Matches are grouped into analytics, tag managers, advertising pixels, session recording and consent managers, each with the text that matched.
The tracking level is our own rule of thumb: high if any ad pixel or session recorder is present, medium for standard analytics or a tag manager, low when only cookieless analytics are found.
