Cookie scan: detect services and cookies

Before the banner has anything to offer, it has to be clear what actually loads on the website. For that the scanner fetches your own pages and evaluates them. The result gives rise to the service list, the blocking rules and the basis for the cookie declaration.

1. Open “Kakapo Consent” and select the “Rules” group, then the “Cookies” item.
2. Click on “Scan now” at the top right — the run fetches the home page and the four most recent posts, so at most five addresses.
3. In the table, check the service, host, category and the “Active” switch for each row; category and switch save immediately.
4. If something is missing, use “Add service” to enter the name, host and category by hand.
5. For a more complete result, go to “Start deep scan” on the “Deep scan” card.

What a run evaluates

• All addresses in src and href attributes of the HTML that point to a third-party host
• The Set-Cookie headers of the response — this is the only way cookies set on the server side become visible at all, together with their measured duration
• Inline scripts on the page based on known patterns, among others for Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, Matomo, Hotjar, Microsoft Clarity, LinkedIn, TikTok, Plausible, HubSpot and Intercom
• Cookie names that a script sets itself via document.cookie
• The plugin’s own code is skipped, and cookies that a response is deleting at that moment are not reported as a finding

The deep scan

The deep scan has a page budget of its own (default 8, at most 60), follows internal links on request and can be restricted via path patterns (“Do not crawl”, one pattern per line). Every third-party host is logged with a hit count, the place it was found and the kind of embedding — script, link, iframe, img, source, video, audio, embed, object and form, including addresses set later from data-src or data-lazy-src. Plain links are left out. Known trackers automatically end up in the service list, everything else you can “Apply” one by one or “Ignore” permanently.

The three findings cards

• “Cookies found”: name, duration, provider, purpose and whether the name comes from a Set-Cookie header or from a script; “Apply” creates it in the cookie declaration
• “Trackers in the page source”: services that sit directly in the page without a script file of their own, with a hit count and — where present in the code — the container or measurement ID
• “Cookies from active plugins”: what the built-in knowledge base knows about the active plugins, with the marker “seen” if the name actually appeared in the last scan

Scanning regularly

1. Open “Kakapo Consent” and select “General” (in German: „Allgemein“).
2. On the “Logging & automation” card, set the “Automatic cookie scan” to daily, weekly or monthly.
3. If needed, enter a “Notification email”; empty means the address of the site administrator.
4. Switch on “Report new services” so that an email arrives after every automatic run as soon as previously unknown hosts appear.
5. Use “Run now” to trigger the run immediately; below it you can see the next and the last run.