Skip to main content
Open Signals → Cookie scan to inspect what your website sets or requests before a visitor chooses consent. The scan and public cookie declaration are available on every plan. A completed scan reports observations from the pages it visited; it does not automatically block other scripts or establish that every page is clear.

​
Before you begin

  • Install Signals and confirm an eligible arrival from your website. Hostnames come from the workspace’s arrival history; you cannot scan an arbitrary domain from this screen.
  • Sign in with workspace access. Rescanning requires permission to update Signals; viewing the report does not.
  • Have access to your website or tag manager if you need to change a script’s consent behavior.

​
How do I run and read a scan?

1

Choose your hostname

Open Signals → Cookie scan and find the website hostname. Check its last scan time and status. Use Rescan to queue another scan after changing your site. Manual rescans are limited to three per hostname per UTC day.
2

Wait for completion

Queued or pending means no completed result is available yet. Blocked and failed scans leave findings unknown. A truncated scan can have useful findings while missing other pages or requests.Scanned from reports the scanner browser’s measured country. Unknown means it could not be established. This is not a list of visitor countries or a test of every regional version of your banner.
3

Inspect the findings

Review Findings, Cookies by category, and the visited pages. The report includes cookie metadata, local/session storage key names, and third-party request hosts. It does not expose cookie or storage values.Categories include necessary, functional, analytics, marketing and uncategorized. Review unknown classifications against the service’s own documentation. No findings from a complete, untruncated scan means none were observed in that scan; it is not a guarantee about unvisited pages.
4

Change the responsible script and rescan

Follow the fix guidance attached to a finding where available. Check the script’s site-wide template, plugin or tag-manager trigger. Keep scripts that require consent from running before the relevant choice.Enabling the Plainrouter banner does not automatically intercept every third-party script on your site. Test rejection, partial acceptance and withdrawal with the consent checks, then rescan.
On the same screen, choose Copy embed code under Publish your cookie declaration. Paste the entire block into the HTML of your cookie-policy page where the declaration should appear:
Use the workspace’s Publishable key, which is intended for browser use. Never substitute a Server secret or Workspace key. Your CMS must allow the container and external script; MDN describes how external script elements load. The declaration lists metadata from the workspace’s latest completed scan and updates after another scan completes. It does not merge every historical scan or list cookie values. If the workspace has several hostnames, check which hostname the latest completed scan covered before using the declaration as a site-wide inventory.

​
How do I verify the embed?

Open the published page in a fresh browser context. Confirm the container renders a scan date and categories matching the completed scan. In the Network panel, check the declaration script and its data request for errors. A blank declaration before any completed scan does not mean the site sets no cookies.

​
Can an AI assistant read the scan?

Use get_cookie_scan with a Read or Write workspace key. It reads retained scan results and does not queue a scan, visit your website or change scripts. No Meta ad account is required. Include workspace_id when the key covers multiple workspaces.

​
Troubleshoot

For recorded Analytics and Marketing decisions, see Consent choices and receipts. Scan findings and consent rates answer different questions: one observes the website; the other reads recorded decisions.