Cookie Scanner

The Cookie Scanner is an admin-triggered scan that discovers cookies and tracking scripts on your site so you can categorize them. You start each scan yourself; CookieRay then crawls pages on your own domain and reports what it finds.

How the scan works

CookieRay uses the WordPress HTTP API (wp_remote_get) to fetch public URLs on the same site domain. The sources it pulls from include:

• Your homepage
• Your published posts and pages, including other public content types
• WooCommerce shop, cart, checkout and account pages, when WooCommerce is active
• The WordPress login page, and the registration page if registration is on
• Up to 100 URLs from your XML sitemap

Cookie names found during the scan are merged into your inventory for categorization. To help classify them, CookieRay uses its bundled tracking-cookie reference data, which is local to the plugin — no external calls are made for this reference data.

Script discovery

Beyond cookies, a deeper script-discovery pass analyzes the HTML from a bounded set of up to 50 URLs on the same domain. CookieRay chooses these URLs from:

• Your XML sitemap, when it lists enough URLs, or
• The home page plus recent posts and pages

This pass helps surface tracking scripts present on your pages.

A browser check from the admin

When you start a scan, CookieRay also loads your home page in a hidden frame in your own admin browser and reports the cookies and browser storage it sees there. This helps catch items a server-side request can’t see. The frame is removed automatically after a short time.

No automatic scans

In the free plugin there are no recurring or scheduled automatic scans. Every scan is started by a user. CookieRay Pro adds scheduled scans (daily, weekly, or monthly). Once you start it, background processing finishes the run.

Coverage and limitations

The server-side crawl sees what an unauthenticated visitor can reach on your own domain, plus what your admin browser shows during the browser check. Coverage depends on:

• Caches
• Auth-only flows (content behind login)
• What the unauthenticated crawler can actually reach

Because of these factors, a scan reflects the reachable surface of your site rather than every possible page state. Scan requests ask for fresh pages (they bypass most page caches), but some caches may still serve stored versions.

Running a scan

1. Start the scan from the Dashboard (Start New Scan), Scan History (Scan Now), or Cookie Inventory → Bulk Actions → Run new scan.
2. Wait while it runs.
3. Let background processing complete the run. Past scans appear in Scan History.
4. Review newly discovered cookies in your Cookie Inventory and categorize the ones that need it. Many arrive already categorized from CookieRay’s reference data.