Cookie scanning
⚡ HTTP Scan
A server-side HTTP request to your target URL, following up to five redirects, capturing every Set-Cookie response header at each hop. Takes about 2 seconds. No browser involved, so JavaScript-set cookies are not captured in this mode.
🔬 Deep Scan (headless browser)
Launches a real Chromium browser, crawls up to 10 same-site pages in one context, waits for network activity to settle, and captures cookies plus localStorage/sessionStorage key names. Detects an "Accept all" consent control when present and records storage before and after that interaction.
Security attribute classification
Every cookie found is checked for a missing Secure attribute, missing HttpOnly, weak or absent SameSite, and SameSite=None without Secure (which modern browsers reject outright). Findings are ranked by severity, not just listed.
Third-party & tracking detection
Cookies set by domains other than the one you scanned are flagged separately, since they represent cross-site tracking exposure rather than first-party session state.
Managed CMP (consent banner)
Register a domain in your account and CFT issues a unique site_* deployment key. A single script tag (/cmp/{siteKey}.js) renders a consent banner that blocks scripts you've categorized (analytics, marketing, preferences) until the visitor makes a choice. Configuration — colors, policy link, categories — updates centrally without you touching the installed script tag again.
Free plan deployments show CFT branding in the banner footer; paid plans do not.
What CFT does not do (yet)
We'd rather tell you this upfront than have you find out after signing up:
- No Google Tag Manager server-side integration, no Google Consent Mode v2 signal dispatch, and no IAB TCF v2.3 consent-string generation. If you specifically need TCF-compliant programmatic ad auctions, CFT's Managed CMP is not yet the right fit.
- No pre-built legal template library per jurisdiction (GDPR/CCPA/LGPD/etc.) — CFT gives you the technical scanning and blocking tooling; your privacy policy and legal categorization remain your responsibility. See the Cookie Compliance Guide for a plain-English overview of what the technical controls typically need to satisfy.
- Deep Scan only crawls same-site pages reachable from the entry URL — it does not authenticate, so cookies set behind a login wall are not captured.
Plans at a glance
| Plan | Deep scans / month | Pages per scan | Managed CMP domains | Price |
|---|---|---|---|---|
| Free | 3 | 3 | 1 (branded) | $0 |
| Starter | 25 | 10 | 1 | $9/mo or $90/yr |
| Growth | 100 | 25 | 5 | $24/mo or $240/yr |
| Agency | 500 | 50 | 25 | $59/mo or $590/yr |