Cookie and Consent Checker
See which cookies a page sets before any consent, and whether their security flags are right.
About this tool
Reads the cookies a page sets on its very first response — before anything is clicked, before any banner is answered.
That timing is the point. A cookie set on the first response was set without consent, whatever the banner says afterwards. If a tracking cookie appears here, the consent banner on that site is decorative.
It also checks the security flags. `HttpOnly` is what stops a session cookie being read by injected script; `Secure` stops it being sent over plaintext; `SameSite` is the main defence against cross-site request forgery. A session cookie missing any of them is a real problem rather than a tidiness note.
Common questions
Which cookies need consent?
Anything not strictly necessary to deliver what the visitor asked for. A session cookie for a logged-in area does not need consent; analytics and advertising cookies do, under GDPR and the ePrivacy directive.
What does HttpOnly actually prevent?
It stops JavaScript reading the cookie. If a page ever suffers an XSS flaw, HttpOnly is what keeps the session cookie from being posted straight to an attacker. Session cookies should always have it.
What should SameSite be set to?
Lax for most cookies, which browsers now assume by default. Strict for anything sensitive. None only when a cookie genuinely must travel cross-site, and then Secure is mandatory alongside it.
Does this show every cookie a site sets?
No, and the difference matters. It shows cookies set in the first HTTP response. Cookies written later by JavaScript, including most analytics ones, are invisible here — a clean result is not proof of a compliant banner.