Is CFT free to use?
Yes. HTTP Scan is unlimited and free for anyone, with no account required. The Free plan account tier also includes 3 Deep Scans per month (up to 3 pages each) and one Managed CMP domain with CFT branding. Paid plans raise those Deep Scan and page-crawl limits and remove branding.
What's the difference between HTTP Scan and Deep Scan?
HTTP Scan reads only the Set-Cookie headers returned by the server — fast, but it misses cookies set by JavaScript after the page loads. Deep Scan launches a real headless browser, crawls multiple pages, and also captures localStorage/sessionStorage keys, at the cost of taking longer and counting against your monthly quota.
Does CFT store the cookies it finds?
No. Cookie values are always redacted — CFT never logs or stores cookie content, only the metadata needed to assess security (name, domain, attributes). Scan targets are not retained beyond generating your report.
Does CFT replace a lawyer or a formal GDPR/CCPA compliance review?
No. CFT is a technical scanning and consent-blocking tool. It helps you see what's actually happening on your site and gives visitors a way to control non-essential scripts, but categorizing vendors correctly and writing your privacy policy remain your (or your counsel's) responsibility. See the Cookie Compliance Guide for background.
Can I install the Managed CMP on more than one domain?
Yes, depending on plan: Free and Starter support 1 domain, Growth supports 5, and Agency supports 25. Each domain gets its own unique deployment key so configuration changes on one site never affect another.
Do I need to touch the installed script again after changing settings?
No. The installed snippet is domain-bound but not settings-bound — colors, the policy URL, and blocked categories are fetched live from your account each time the banner loads, so you only ever edit them from the CFT dashboard.
Does CFT support Google Consent Mode v2 or IAB TCF?
Not yet. CFT's Managed CMP blocks and unblocks scripts by category, but it does not currently dispatch Google Consent Mode v2 signals or generate an IAB TCF v2.3 consent string. If your ad stack specifically requires TCF signaling, CFT isn't the right fit today.
How is CFT different from other consent management platforms?
Most consent platforms start from the legal/consent-workflow side. CFT started as a security scanner — it classifies cookie security attributes (Secure, HttpOnly, SameSite) and flags session/XSS/CSRF-relevant misconfigurations, then adds the consent banner as a practical next step once you know what you're actually blocking. See the full comparison page.
Can I cancel a paid plan anytime?
Yes. Billing is handled through Stripe's Customer Portal, accessible from your Account page, where you can change plans or cancel without contacting support.
What are CFT's known limitations?
Neither scan mode authenticates, so cookies behind a login wall are missed. Deep Scan only follows same-site links reachable from your entry URL. HttpOnly cookie values are never visible in either mode — only their presence and attributes are. See the full breakdown on the Features page.