Free audit
Are the cookies and documents on your site in order?
Type your site's address. We go through 36 things, and we say just as plainly what we could not see.
yoursite.com
Waiting for an address
- tracking cookies
- cookies from another domain
- cookie lifetime
- cookies we could not classify
- cookies written by scripts, not seen
- tags and the consent tool
- Google Tag Manager
- whether the tags wait for consent, not seen
- privacy notice
- terms
- company details
- contact as text
- link to the privacy notice
- pre-ticked box
- HTTPS
- redirect to HTTPS
- HSTS
- mixed content
- Secure flag
- HttpOnly flag
- server version
- exposed configuration files
- error log and folder listing
- Google fonts
- YouTube video
- Google Maps
- reCAPTCHA
- page language
- page title
- alt text
- main heading
- mobile viewport
- zooming
- form labels
- frame titles
- skip link
- landmarks
- contrast, keyboard and screen reader, not seen
- the chat's AI notice
- AI behind the scenes, not seen
36 checks, 8 questions, about 15 seconds.
Four things stay out of our sight. See what the audit cannot see
Why this drifts out of shape without anyone noticing
The cookie banner was installed once and nobody has looked since to see whether it holds anything back. The privacy notice was written before three new tools were added.
The page looks exactly the same the whole time. Before anything can be fixed, somebody has to look.
What the audit actually looks at
The audit reads your page in the order a browser opens it: the connection, the server's answer, the page code.
The connection and the cookie flags
HTTPS, the redirect to the secure connection, HSTS and mixed content. We also look at whether the cookies carry the Secure and HttpOnly flags, and whether the server hands out files that should be closed.
The cookies the server sent
We read every cookie that arrived with the very first response. We look at whether any of them is a known tracking cookie, whether any belongs to another domain, and how long each one is set to last.
Who is measuring on the page
Which analytics and advertising tags load on the page, and whether there is a consent tool there to hold them back. Measuring is not an accusation in itself. The only question is whether anyone is asked first.
The basics of accessibility
The page language and title, alt texts, form labels, whether zooming is allowed, a skip link and landmarks. This is the machine-findable part of accessibility, which is a long way from all of it.
What leaves before consent is given
Fonts pulled straight from Google, a YouTube video in its ordinary form, a map embed and reCAPTCHA. Each of them passes something about the visitor on the moment the page opens.
The forms that ask for data
Whether a form links the privacy notice, and whether a consent box arrives already ticked. Consent has to be the person's own act.
The documents people expect to find
Whether a privacy notice exists and is linked, whether there are terms, whether the company registry code is on the page, and whether anyone can get in touch with you at all.
The chat window and AI
Whether there is a chat window on the page, and whether it says beside it that a machine answers. One sentence that is easy to forget.
What this audit does not tell you
It does not tell you whether your business is compliant. It tells you what one request to one page was able to show.
| Subject | The audit sees | The audit does not see |
|---|---|---|
| Cookies | The ones the server sent with its very first response | The ones a script on the page writes. Most analytics and advertising cookies are exactly those |
| Measuring | Which tags are on the page, and whether a consent tool is there | Whether the tags really wait until the visitor has clicked |
| Accessibility | What is written in the code: the language, alt text, form labels | Colour contrast, getting through with a keyboard, and how the page sounds in a screen reader |
| AI | The chat window and the sentence beside it | Where a model meets a customer behind the scenes in your business |
| Rules | What one request to one page was able to show | Which rules apply to your business in particular. That depends on what you collect, who you share it with and on what basis |
A clean result means only this: we saw nothing wrong from where we stand. Compliance is decided by a lawyer, not by a scan.
If you want somebody to actually do it
The audit tells you what is out of order. From there you have three routes. Start with whichever matters most for the state your site is in.
One-off work
Fix-up package
The whole list worked through and done, not just handed over as a report.
- a cookie banner that really holds the scripts back until consent
- a privacy notice and terms written from your real tools, not from a template
- registry code, address and contact details where a visitor can see them
- fonts, videos and maps set up so they send nothing before their time
- the machine-findable accessibility defects fixed
Ongoing service
Web management
These things do not stay in order after one round. A new plugin, a new tool, a new form, and the list has moved again.
- updates and backups, without you having to remind anyone
- a repeat audit and a short note on what changed in between
- new tools written into the cookie banner and the privacy notice
- one place to ask when something is unclear
If it is all unclear
Let us talk it through first
If you do not know which rules apply to your business in particular, the first step is a conversation, not an order.
- we go through the audit result together
- we say what is a couple of hours' work and what is a bigger job
- if the answer needs a lawyer, we say that too
Frequently asked questions
- Do I have to do anything if all I have is a simple brochure site?
- It depends on what actually happens on the page. If the site is genuinely static, measures nothing and collects nothing, the list is short: contact details and the registry code where people can see them, and a short privacy notice about what happens when somebody writes to you. Most brochure sites do measure something anyway, because somebody once added Google Analytics or a Facebook pixel and it stayed there. The audit shows which of the two your site is.
- Is a cookie banner compulsory?
- The banner itself is not. The asking is: if the site stores something on a visitor's device that is not strictly necessary for the page to work, the asking comes first. If your site measures nothing and tracks nothing, there is nothing to ask about and a banner is just an annoyance. And a banner that only informs, without holding the scripts back, does not do that job. It is the most common thing we find on sites.
- What is this AI Act?
- The European Union's regulation on artificial intelligence. For a small website usually only one part of it applies: if a machine is talking to your visitor, they have to be able to tell. In practice that is one sentence at the top of the chat window: that an AI answers, and how to reach a person. The audit looks at whether there is a chat window on the page and whether such a sentence sits beside it.
- Is the audit really free?
- Yes. You see the score and the two most important findings straight away, without typing anything. The rest of the findings, with what to do about each one, we send by email. That is the only place we ask for an address, and you can see what you are giving it for before you do.
- The audit said nothing looks wrong. So is everything in order?
- That we do not say, and cannot. Our audit reads what the server sent and what is written in the page's HTML. The rest you can check quickly yourself: open the page in a private window, press F12 and look at the Application tab to see which cookies appear before you touch the cookie banner.
- The audit found several things. How big a job is that?
- Usually smaller than the list looks. Most findings are a matter of one setting or one paragraph: a cookie lifetime, a missing link to the privacy notice, an alt text, the page language. Real work usually means two things: a cookie banner that really holds the scripts back, and a privacy notice written from your real tools. And even those are a question of days, not months.
- Do you make these fixes as well?
- Yes, if you want. With the fix-up package we work through the list and get it done; with web management we keep it in order afterwards too. But you do not have to hire us for that: the report says what to do beside every finding, and you can send that link straight to your own developer.
- What do you do with my email address?
- We send you the audit result, and we get in touch if it looks like we can help. We do not sell addresses on and we do not add you to a newsletter. Every email can be unsubscribed from with one click, and you can ask for your data to be deleted at any time.
- Is this legal advice?
- No. We are not lawyers and the audit is not legal help. It is a technical observation: we say what we saw on one page with one request, and why it matters at all. Our job is to make visible the things you can then go and ask a lawyer about.
There are two more audits for the same address
Both are free.
Run the audit on your site, then we can talk
If nothing looks wrong, you know more than you did. If something does, you know exactly where to start.
Run the audit