Scanning Your Site for Trackers and Cookies
Choose which domains and subdomains Concord scans for trackers, set a schedule or scan on demand, and review what each scan finds.
Concord's tracker scanning finds the cookies, scripts, iframes, images, and other trackers running on your websites, so your Cookies & Scripts list stays current. You control exactly what each scan covers, how often it runs, and what it costs.
This guide covers how to:
- Choose which domains and subdomains a scan covers
- Scan on a schedule or on demand
- Understand scan frequency and cost
- Turn on Deep Scan and Real-Time Scan
- Review scan history and scan results
Choosing What a Scan Covers
Each project has one tracker scan that covers its domains in a single run. Set it up under Consent → Cookies & Scripts → Settings, in the Scan Coverage & Schedule card.
- Project Domains: every domain in the project is included by default. Uncheck a domain to leave it out of the scan.
- Extra Subdomains: add subdomains beyond your project domains, like
app.yourdomain.com. Each extra subdomain uses 1,000 Actions on every run, scheduled or on demand.
Scanning on a Schedule
- Go to Consent → Cookies & Scripts → Settings.
- In Scan Coverage & Schedule, turn on Enable Scheduled Scans.
- Choose how often the scan runs. New schedules default to monthly.
- Save your settings.
Concord picks an off-peak time for each scheduled run, so there's no day or hour to set. Scheduled runs include your registered project domains at no cost; only extra subdomains use Actions.
Scan Frequency by Plan
Your plan sets how often scheduled scans can run. See pricing for plan details.
- Lite: quarterly
- Essentials: monthly
- Pro: weekly
- Premium and Enterprise: daily
Scheduled and on-demand scans are available on paid plans.
Scanning on Demand
- Go to Consent → Cookies & Scripts → Scan History.
- Click Scan Now.
- Review the cost shown in the confirmation, then confirm.
An on-demand scan uses 1,000 Actions for each domain it scans, including your project domains, drawn from your monthly Actions allowance. See Actions and Data Credits.
Tracker Scan Settings
Under Consent → Cookies & Scripts → Settings, the Tracker Scan Settings card has options for broader coverage:
- Enable Deep Scan: looks for less common potential trackers (scripts, iframes, links, images, and more) that don't match Concord's global tracker library. Deep Scan surfaces many more items and usually needs a longer review. Most can be ignored, but anything that interacts with or stores customer data should be classified. It's most useful during audits or stricter compliance checks.
- Enable Real-Time Scan: detects cookies and scripts as visitors use your site, which catches trackers that only load in certain situations. Detected items appear in Scan Results for review.
- Auto-Add Backend Scan Matches: adds scheduled and on-demand scan detections that match Concord's global tracker library to your Cookies & Scripts list automatically. When it's off, matches still appear in Scan Results for you to add.
- Auto-Add Real-Time Scan Matches: does the same for real-time detections. It's off by default so you can review real-time matches first.
Scan History
Go to Consent → Cookies & Scripts → Scan History to see every scan run for the project, with its date, trigger, result, and duration. Expand a run to see its results, including total trackers, new trackers, project matches, and global matches.
Scan Results
Go to Consent → Cookies & Scripts → Scan Results to categorize and associate the cookies and scripts discovered by real-time and scheduled scans.
This list is different from the Cookies & Scripts tab. Cookies & Scripts is your production list: it decides which trackers are blocked and shown to visitors on your site. Scan Results shows what recent scans found, so you can decide what to add. Each detected tracker shows how it matched:
- Project: already in your Cookies & Scripts list.
- Global: matches a tracker in Concord's global library.
- New: no known match. You can add it to your Cookies & Scripts list from here.
Click Add to move a discovered tracker into your Cookies & Scripts list. For how to categorize unclassified or ignored trackers, see Discovery and Classification of Trackers (Cookies & Scripts).
You can also sort, filter, and export the list to CSV.
Related Articles
Running Compliance Scans
Test how your live site handles consent: choose jurisdictions and checks, run a Compliance Scan once or on a schedule, and turn failed checks into tasks.
Configuring Auto-Blocking of Cookies and Scripts
Understanding and configuring Concord to enable auto-blocking of cookies and tracking scripts and required user consent settings.