About the Website Privacy X-Ray
Enter any address and see what the page actually loads — the part that happens in the second before a cookie banner appears, when a browser has already reached out to a dozen companies on your behalf.
The scan reports every third-party domain the page references, resolved to the company that owns it, so a wall of unfamiliar hostnames collapses into a handful of real recipients. Alongside that: tracking pixels, the cookies set in the response with their genuine lifetimes rather than the reassuring ones in the policy, the fingerprinting APIs named in the page, whether a real consent platform and a privacy policy exist, and the response headers — Content-Security-Policy, Referrer-Policy, Permissions-Policy — that govern how much leaks to each of them.
One limit stated plainly, because a privacy tool that overstates its own reach is not much of a privacy tool: this is a static scan. It reads the HTML the server sends but does not run JavaScript, so anything a tag manager loads afterwards is invisible to it. Where a tag manager is present the report says so. Every number here is a floor, never a ceiling. Fetching happens from our server through an SSRF-hardened resolver, so the site you scan never sees your browser.
Only cookies set by HTTP headers on the page itself. Cookies written later by JavaScript — which is most advertising cookies — cannot be seen by a static scan.
Scan a second site and put the two reports next to each other — the fastest way to show a client, or a colleague, what “a lot of tracking” actually means.
Every scan you run is snapshotted in this browser. Scan the same site again in a month and the change is shown against the last run. Nothing is uploaded.
How to Use the Website Privacy X-Ray
Enter any public web address and press X-Ray. Our server fetches the page and reads what it
references; your own browser never touches the site, so scanning somewhere does not add you to its
audience. Read the grade first, then the Who This Page Contacts table, which is the
substance of the report — it names the company behind each domain, which is what turns
adnxs.com from meaningless into “Microsoft’s ad exchange”. Scanning
a checkout page or an article is often more revealing than the homepage, because that is where the
conversion tracking lives.
What Actually Happens When a Page Loads
You typed one address, so it feels like one connection. In practice a modern commercial page
triggers dozens. Each one carries, at minimum, your IP address (approximate
location and network), your user agent (browser, operating system, versions), and
the Referer header — the exact page you were reading when the request fired.
That last one is the quiet part: unless the site sets a strict Referrer-Policy, every
third party learns not just that you visited the site, but which article, which product, which
symptom you were looking up.
The same handful of companies appear on most sites, which is precisely how cross-site profiling works. If one advertising network is embedded on a hundred thousand sites, it does not need to follow you: you keep arriving. Recognising a familiar name across unrelated scans is the moment the mechanism becomes obvious.
Cookies Are the Old Problem; Fingerprinting Is the Current One
Cookie regulation worked, in a narrow sense: it made cookies visible, contestable and deletable. The industry responded by moving to techniques that are none of those things. Browser fingerprinting identifies your device from its own characteristics rather than from anything stored on it — how your graphics hardware renders a hidden image, how your sound stack processes an inaudible tone, which fonts are installed, your screen size, your CPU core count, your time zone. Individually these are unremarkable. Combined, the set is frequently unique across millions of devices.
The important asymmetry: you cannot clear a fingerprint. Deleting cookies, using private browsing, and rejecting every banner all leave it perfectly intact, because nothing was ever written down. When this scan reports canvas, WebGL or audio fingerprinting, it means the page contains code capable of building a device identifier that survives every consumer countermeasure except a browser that actively randomises the signals.
Reading the Cookie Table Properly
Three columns matter more than the rest.
- Lifetime. A session cookie disappears when you close the browser. A cookie with a two-year expiry is a two-year memory of you. Advertising identifiers are habitually set to the maximum a browser will honour — and Safari and Firefox now cap script-set cookies to seven days precisely because of this.
- First or third party. A cookie scoped to the site you are on is usually doing a job you want: keeping you logged in, remembering your basket. A cookie scoped to somebody else’s domain exists to recognise you on their other properties.
- SameSite.
StrictorLaxmeans the cookie is not sent on cross-site requests, which blunts cross-site tracking considerably.Noneis an explicit opt-in to being sent everywhere, and it is what advertising cookies use.
Why Cookie Banners Often Change Nothing
A consent banner is supposed to gate the trackers: nothing loads until you agree. The common implementation does the opposite — the tags are in the page from the start, the banner is cosmetic, and your choice is applied only to what happens next. By then the page view has been reported. European regulators have repeatedly found and fined exactly this pattern, along with banners where “accept” is one click and “reject” is four.
This scan tells you whether a recognised consent platform is present at all, and which vendor runs it. It cannot tell you whether that platform is configured to actually block anything before consent — that requires watching the page execute. What it can tell you is when there is no consent layer at all yet a dozen advertising domains are referenced, which is its own answer.
What You Can Do About Any of This
- Use a browser that blocks by default. Firefox with Enhanced Tracking Protection set to Strict, or Safari with Intelligent Tracking Prevention, removes most of what this report lists without any configuration.
- Add a content blocker. A well-maintained blocklist stops the requests before they are made, which is categorically better than stopping the cookie afterwards.
- Separate contexts. Container tabs or separate profiles for shopping, banking and general browsing break the thread that joins those activities into one profile.
- If you run a site, count your own third parties. Most sites carry tags nobody remembers adding, for campaigns that ended years ago. Every one is a company receiving your visitors’ data and a dependency you did not audit. Scan your own domain here and be honest about how many of the results you can justify.
Checking a specific link rather than a whole site? The Scam & Phishing Link Analyzer resolves where it goes and how old the domain is. Browse every Security & Privacy tool for more.
Frequently Asked Questions
Why does a news site load forty different third-party domains?
Because programmatic advertising is an auction, and every bidder needs to see you to bid. A single ad slot triggers calls to an ad server, several exchanges, identity-resolution services that match you across sites, and measurement vendors who verify the ad was displayed. Each of those receives your IP address, the page you are reading and usually a shared identifier. Nobody at the publisher chose forty companies individually; they chose one ad platform and the rest arrived with it.
What is browser fingerprinting and why is it worse than cookies?
Fingerprinting identifies your device from characteristics rather than from something stored on it: how your GPU renders a hidden image, which fonts are installed, your screen dimensions, your CPU core count. Combined, these are often unique to one device. It is worse than cookies in one specific way — you cannot delete it. Clearing cookies, using private browsing and rejecting consent all leave the fingerprint intact, because nothing was ever stored to remove.
Does rejecting cookies in the banner actually stop the tracking?
Sometimes, and less often than it should. A properly implemented consent platform blocks the tags until you agree. Many implementations load the trackers first and only apply your choice afterwards, which means the initial page view has already been reported. Repeated regulatory enforcement across Europe has found exactly this. A scan like this one shows what is referenced in the page source, which tells you whether the tags are present at all.
Why does this scan sometimes find fewer trackers than my browser extension?
Because this is a static scan. It reads the HTML the server returns but cannot execute JavaScript, so anything a tag manager loads at runtime is invisible to it — and a tag manager exists precisely to load things at runtime. When one is detected the scan says so explicitly. Treat the numbers here as a floor: the real count is this or higher, never lower.
What is a reasonable number of third-party domains for a website?
A well-built site with no advertising typically contacts zero to three: perhaps a font host, a CDN and one analytics endpoint. A site with a payment processor or embedded video will reach five to ten. Beyond about fifteen you are almost certainly looking at programmatic advertising, and beyond thirty the page is primarily an advertising surface that happens to contain content.
