Cookie Scanner - Cookie Security Flags & Tracker Check by URL

Cookie Scanner — GDPR & security audit for any URL

Cookie Scanner reads every Set-Cookie a page sends and reports each cookie's Secure, HttpOnly, SameSite and expiry settings, third-party and tracker flags and a GDPR category guess, at $0.0008 per page on the Apify Free plan.

• Price: $0.0008 per page scanned on the Free plan, less on paid plans. A URL that cannot be fetched is not charged.
• Example input: { "urls": ["https://github.com"] }
• Output fields: ok, url, statusCode, cookieCount, sessionCount, persistentCount, thirdPartyCount, trackerCount, cookies, issues

Scan a page's cookies for privacy and security review. Parses every Set-Cookie into structured attributes (Secure, HttpOnly, SameSite, expiry), flags third-party and tracker cookies, guesses a GDPR category (analytics/ads/functional), and lists security issues. Single URL or bulk. $0.0008 per page. Failed fetches are recorded free.

What you get

• Per cookie: name, domain, path, secure, httpOnly, sameSite, expiresDays, session, thirdParty, category.
• Counts: cookieCount, sessionCount, persistentCount, thirdPartyCount, trackerCount.
• issues — security flags (missing Secure/HttpOnly, weak SameSite, long-lived trackers).
• Fail-soft: an unreachable URL returns {ok:false, error} and is never charged.

Input

{ "urls": ["https://github.com", "https://example.com"], "maxUrls": 25 }

Output (real run, 2026-08-07)

{
  "ok": true, "url": "https://github.com", "statusCode": 200,
  "cookieCount": 3, "sessionCount": 1, "persistentCount": 2, "thirdPartyCount": 0, "trackerCount": 0,
  "cookies": [
    { "name": "_gh_sess", "domain": "github.com", "secure": true, "httpOnly": true, "sameSite": "Lax", "session": true, "category": "unknown" }
  ]
}

Example

A real run on 2026-10-31 with the input this page's form is prefilled with:

{
  "url": "https://github.com"
}

It finished in 2 seconds and returned 1 result. It was charged for 1 page-scanned event ($0.0008 on the Free plan). The first result (long text and lists cut for display):

{
  "ok": true,
  "url": "https://github.com",
  "finalUrl": "https://github.com/",
  "statusCode": 200,
  "cookieCount": 3,
  "sessionCount": 1,
  "persistentCount": 2,
  "thirdPartyCount": 0,
  "trackerCount": 0,
  "cookies": [
    {
      "name": "_gh_sess",
      "domain": "github.com",
      "path": "/",
      "secure": true,
      "httpOnly": true,
      "sameSite": "Lax",
      "expiresDays": null,
      "session": true,
      "thirdParty": false,
      "category": "unknown"
    },
    {
      "name": "_octo",
      "domain": ".github.com",
      "path": "/",
      "secure": true,
      "httpOnly": false,
      "sameSite": "Lax",
      "expiresDays": 365,
      "session": false,
      "thirdParty": false,
      "category": "unknown"
    },
    {
      "name": "logged_in",
      "domain": ".github.com",
      "path": "/",
      "secure": true,
      "httpOnly": true,
      "sameSite": "Lax",
      "expiresDays": 365,
      "session": false,
      "thirdParty": false,
      "category": "unknown"
    }
  ],
  "issues": [
    "_octo: missing HttpOnly flag"
  ]
}

Pricing — $0.0008 per page

$0.0008 per page scanned on the Apify Free plan, billed as the page-scanned event. Paid Apify plans pay less ($0.00074 Bronze, $0.0007 Silver, $0.00064 Gold, $0.00058 Platinum, $0.00054 Diamond). No start fee. Failed fetches are recorded free. A page that sets no cookies was scanned successfully and is charged.

Limits (honest ones)

• Reads cookies set in the HTTP response headers (Set-Cookie) on a single page load — it does not run JavaScript, so cookies set later by client-side scripts are not captured.
• GDPR category is a heuristic from the cookie name, meant to triage, not to certify compliance.
• maxUrls sets how many URLs one run scans (50 by default).

FAQ

• Does it capture JS-set cookies? No — it reads Set-Cookie response headers; client-side document.cookie writes are out of scope.
• What are the security flags? Missing Secure/HttpOnly, weak/absent SameSite, and long-lived third-party trackers.
• Is the GDPR category authoritative? It is a name-based heuristic for triage, not legal compliance certification.
• What about a dead URL? You get an {ok:false, error} record, uncharged.
• Can I scan many pages at once? Yes. Pass a urls list; one record comes back per page, 50 per run by default (raise maxUrls for more).

Related actors

• HTTP Headers Inspector (EliAI/http-headers-inspector) — returns every raw response header (including Set-Cookie) with a security-header grade. This actor goes deeper on cookies specifically: it parses each one into attributes + GDPR/tracker flags.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~webpage-cookie-scanner/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' -d '{"urls":["https://github.com"]}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

Changelog

• 2026-11-01: Page text only: an Example section from a real run. Code, output and price are unchanged.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/webpage-cookie-scanner
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~webpage-cookie-scanner/run-sync-get-dataset-items
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.

Who uses it

• Privacy consultants listing the third-party and tracker cookies a site sets before consent
• DPOs checking cookie categories to update a cookie policy
• Security engineers flagging session cookies missing Secure, HttpOnly or SameSite
• Agencies auditing client landing pages after a new marketing tag is added
• Developers verifying a consent change removed an analytics cookie