Skip to content

Ward opens soon: join the waitlist and we'll email you the day we open.

What Ward checks

Area: Website and certificates

Cookies and trackers

Trackers (analytics, advertising, session recording) and tracking cookies that your homepage switches on before asking for consent, and whether a cookie consent tool is present. Homepage only; a guide, not an audit.

What it can report

Open each one to see what it means and how to fix it.

Trackers without a cookie notice

What it means

Your homepage loads trackers, tools that measure visits or show ads by recording what visitors do, and we don't see a cookie notice or consent tool. This is a guide: we only look at the homepage, before anything is clicked.

What could happen

In California and a growing number of states, visitors must be told about tracking and be able to opt out of the sale or sharing of their data for advertising, and visitors from the EU or UK must opt in before non-essential trackers load. Trackers without a notice are a common reason for complaints. It's a compliance gap rather than a break-in.

How an attacker would use it

It isn't an attack. A visitor, a consumer group or a competitor notices your site records visits with no notice, and sends a complaint. You then have to show what you collect and what visitors were told, which is hard without a notice.

How to fix it

  1. List the trackers your site uses, with the help of the technical details.
  2. Install a consent tool (Cookiebot, Complianz, CookieYes, Iubenda, OneTrust or similar) that blocks them until the visitor chooses.
  3. Update your privacy policy and cookie notice so they match.
  4. If you run advertising trackers, add a “Do Not Sell or Share My Personal Information” link.
  5. Open the site in a private window, decline cookies and check that no tracking cookies appear.

How to check it's fixed

Ward reads your homepage again and looks for a consent tool. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.

Who usually fixes it

vosotros

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Trackers load before consent

What it means

Your site has a Google consent system, but some trackers load directly in the page, without the blocking that consent tools normally apply. It can be fine if consent is applied another way, such as inside Google Tag Manager. This is a guide only.

What could happen

It may mean the trackers switch on before the visitor chooses, which is what privacy rules are about. Or it may be set up correctly and we can't see it from the homepage. That's why the severity is low and the first step is to check.

How an attacker would use it

It isn't an attack. If the trackers really do start before consent, a visitor who declined cookies is still recorded. If they complain, you'd have to show that your tool actually stopped them.

How to fix it

  1. Open your site in a private window and decline cookies.
  2. Check in the browser (Application > Cookies) that no tracking cookies appear before or after declining.
  3. If they appear, ask whoever maintains your site to make the consent tool block those trackers until accepted.With Google Tag Manager, the blocking has to be set up inside Tag Manager itself.
  4. If nothing appears, you can accept this notice: the tool does its job.

How to check it's fixed

Ward reads your homepage again. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Tracking cookies before consent

What it means

Your website's very first response, before the visitor does anything, already places tracking cookies in their browser. Cookies are small files the site leaves in the browser, and these ones serve analytics or advertising. This is a guide only.

What could happen

Privacy rules expect visitors to be told, and in some places to agree, before tracking cookies are set. Cookies installed on arrival are what a complaint usually points to. It's a compliance matter, and the fix is usually a setting in your consent tool.

How an attacker would use it

It isn't an attack. A visitor opens your site, declines everything and later finds the tracking cookies were already there. If they complain, the cookies prove that tracking started before they could decide.

How to fix it

  1. Set up your website so these cookies are only installed after the visitor accepts them in the notice.
  2. If you use a consent tool, check that it blocks the scripts that create these cookies until accepted.
  3. List the cookies in your cookie notice.
  4. Test in a private window: decline cookies and check that none of these remain.

How to check it's fixed

Ward reads the cookies of your homepage's first response again. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.