Third-Party Script & Cookie Audit
List the outside hosts a page loads scripts, frames and images from, and the cookies it sets.
Looks up live data What you enter is sent to our server to fetch live results from public sources. Results are cached briefly. A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
Report a problem with this tool
About this tool
Enter a URL and our server fetches the page, then lists every outside host its HTML loads from: scripts, iframes, images, stylesheets and connection hints. Hosts are grouped by vendor where we recognise them and tagged by purpose, such as analytics, advertising, session replay, CDN, fonts or payments. It counts third-party scripts that block page rendering, counts inline scripts, and lists the cookies set by the page's own response with their security flags and lifetime. Cookie values are never shown. Only the initial HTML and response headers are read, so anything a tag manager or script adds later is not listed, and cookies set by JavaScript are missed. Vendor names and categories are a best guess by host name, so confirm anything important with your browser's network panel.
How to use it
- Enter a domain or page URL.
- Press Audit page.
- Start with hosts marked as tracking, then check the blocking third-party scripts.
- Review cookies without Secure, HttpOnly or SameSite flags, and compare the findings with your privacy policy.
Common problems
- The list is short but I know the page has many trackers
- Most are probably loaded by a tag manager after the page loads. Inspect the container with the GTM Container Inspector.
- No cookies are listed
- Many sites set cookies only through JavaScript or after a consent choice. Only cookies in the page response headers are shown.
- A host has no vendor name
- It is not in our list. It may be the site's own CDN on a different domain, or a smaller service.