Free audit
Are the cookies and documents on your site in order?
The cookie banner, the privacy notice, accessibility and saying out loud that a chat is a machine are the things that slip out of order most quietly on a website: when one is missing, nothing on the page looks any different. Type in your address - we will go through what we can see from where we stand, and say just as plainly what we could not see. The result is on screen straight away, with no sign-up.
Free, with nothing held back. We do not ask for your email until the result is on screen.
What was stored before anyone was asked
The cookies the server sent with its very first response, how long they last, which of them belong to another domain - and whether anything on the page asks first at all.
Are the expected documents there
The privacy notice and the terms, the company registry code, and whether anyone can reach you from the page at all.
Can everybody use the page
The page language and title, alt texts on images, labels on form fields, whether zooming is allowed, and the structure a screen reader needs.
Is the AI declared
Whether there is a chat window on the page, and whether it says beside it that a machine answers. One sentence that is easy to forget.
An honest note: this audit does not tell you whether your business is compliant. It tells you what one request to one page was able to show. We do not run JavaScript on the page, and a script is what writes most analytics and advertising cookies, so those stay invisible to us. Nor can we see which rules apply to your business in particular - that depends on what you actually collect and who you share it with, and none of that can be read off a page. Compliance is decided by a lawyer, not by a scan.
Why this drifts out of shape without anyone noticing
None of these things announces itself on the page. The cookie banner was installed once and nobody has looked since to see whether it holds anything back. The privacy notice was written before three new tools were added. A new plugin brought a cookie from another domain along with it and nobody knows. The page looks exactly the same the whole time. That is why this is maintenance work rather than a one-off project - and before anything can be fixed, somebody has to look.
What the audit actually looks at
The cookies the server sent
We read every cookie that arrived with the very first response. We look at whether any of them is a known tracking cookie, whether any belongs to another domain, and how long each one is set to last.
Who is measuring on the page
Which analytics and advertising tags load on the page, and whether there is a consent tool there to hold them back. Measuring is not an accusation in itself - the only question is whether anyone is asked first.
The documents people expect to find
Whether a privacy notice exists and is linked, whether there are terms, whether the company registry code is on the page, and whether anyone can get in touch with you at all.
The connection and the cookie flags
HTTPS, the redirect to the secure connection, HSTS and mixed content. We also look at whether the cookies carry the Secure and HttpOnly flags - two boxes that usually just get forgotten.
What leaves before consent is given
Fonts pulled straight from Google, a YouTube video in its ordinary form, a map embed and reCAPTCHA. Each of them passes something about the visitor on the moment the page opens.
The basics of accessibility
The page language and title, alt texts, form labels, whether zooming is allowed, a skip link and landmarks. This is the machine-findable part of accessibility, which is a long way from all of it.
If you want somebody to actually do it
The audit tells you what is out of order. From there, three ways on, and you do not have to choose right now - start with whatever matters most for the state your site is in.
One-off work
Fix-up package
The whole list worked through and done, not just handed over as a report.
- a cookie banner that really holds the scripts back until consent
- a privacy notice and terms written from your real tools, not from a template
- registry code, address and contact details where a visitor can see them
- fonts, videos and maps set up so they send nothing before their time
- the machine-findable accessibility defects fixed
Ongoing service
Web management
These things do not stay in order after one round. A new plugin, a new tool, a new form - and the list has moved again.
- updates and backups, without you having to remind anyone
- a repeat audit and a short note on what changed in between
- new tools written into the cookie banner and the privacy notice
- one place to ask when something is unclear
If it is all unclear
Let us talk it through first
If you do not know which rules apply to your business in particular, the first step is a conversation, not an order.
- we go through the audit result together
- we say what is a couple of hours' work and what is a bigger job
- if the answer needs a lawyer, we say that too
It does not tell you whether your business is compliant. It tells you what one request to one page was able to show, and those are two different things. Two limits are fairer said straight out. First: we do not run JavaScript on the page, and a script is what writes most analytics and advertising cookies, so those stay invisible to us - nor can we see whether the tags really wait for consent. Second: which rules apply to your business in particular cannot be read off a page, because it depends on what you actually collect, who you share it with and on what basis. So a clean result means only this: we saw nothing wrong from where we stand. Compliance we do not promise, and could not.
Frequently asked questions
It depends on what actually happens on the page. If the site is genuinely static, measures nothing and collects nothing, the list is short: contact details and the registry code where people can see them, and a short privacy notice about what happens when somebody writes to you. Most brochure sites do measure something anyway, because somebody once added Google Analytics or a Facebook pixel and it stayed there. The audit shows which of the two your site is.
The banner itself is not. The asking is: if the site stores something on a visitor's device that is not strictly necessary for the page to work, the asking comes first. If your site measures nothing and tracks nothing, there is nothing to ask about and a banner is just an annoyance. And a banner that only informs, without holding the scripts back, does not do that job - it is the most common thing we find on sites.
The European Union's regulation on artificial intelligence. For a small website usually only one part of it applies: if a machine is talking to your visitor, they have to be able to tell. In practice that is one sentence at the top of the chat window - that an AI answers, and how to reach a person. The audit looks at whether there is a chat window on the page and whether such a sentence sits beside it.
Yes. You see the score and the two most important findings straight away, without typing anything. The rest of the findings, with what to do about each one, we send by email - that is the only place we ask for an address, and you can see what you are giving it for before you do.
That we do not say, and cannot. Our audit reads what the server sent and what is written in the page's HTML. We do not run JavaScript, and a script is what writes most analytics and advertising cookies. So a clean result means this: from what we can see, nothing looked wrong. The rest you can check quickly yourself - open the page in a private window, press F12 and look at the Application tab to see which cookies appear before you touch the cookie banner.
Usually smaller than the list looks. Most findings are a matter of one setting or one paragraph: a cookie lifetime, a missing link to the privacy notice, an alt text, the page language. Real work usually means two things - a cookie banner that really holds the scripts back, and a privacy notice written from your real tools. And even those are a question of days, not months.
Yes, if you want. With the fix-up package we work through the list and get it done; with web management we keep it in order afterwards too. But you do not have to hire us for that: the report says what to do beside every finding, and you can send that link straight to your own developer.
We send you the audit result, and we get in touch if it looks like we can help. We do not sell addresses on and we do not add you to a newsletter. Every email can be unsubscribed from with one click, and you can ask for your data to be deleted at any time.
No. We are not lawyers and the audit is not legal help. It is a technical observation: we say what we saw on one page with one request, and why it matters at all. Whether any rules apply to your business, and which, depends on what you actually collect, who you share it with and on what basis - a lawyer decides that, not a scan. Our job is to make visible the things you can then go and ask them about.
Also free
There are two more free audits for the same address. One looks at whether Google can find your site, the other at whether an AI assistant can make sense of it.