How to scan cookies on a WordPress site in 60 seconds
WordPress is great in that you can extend your site with plugins. At the same time, that is exactly why many sites have no idea what cookies they really use.
An analytics plugin, a chat widget, a YouTube embed, the Facebook Pixel, reCAPTCHA, a newsletter popup, WooCommerce, a payment gateway, heatmaps. Each of these elements can add its own cookies or load third-party scripts.
If you want your cookie bar to be in order, the first step is not writing a policy. The first step is scanning the site.
Why guessing cookies by hand is not enough
A manual list of cookies quickly goes out of date. A single plugin update or a new marketing campaign is enough for a script to appear on the site that is not in the original cookie declaration.
With WordPress this happens often. The site owner thinks they only use Google Analytics, but in reality they also have the Meta Pixel, Hotjar, YouTube, Google Fonts, a chat and several WooCommerce cookies on the site.
An automatic scan shows you what really happens on the site, not what you think happens.
Step 1: add the domain
In Cookienovo you start by adding the domain of your WordPress site. You do not need to know the technical details. Just the URL of the site you want to check.
After you add the domain, Cookienovo prepares a measurement and CMP script that you insert into the site.
Step 2: insert the script into WordPress
The easiest way is to insert the script into the site header. With WordPress you can do this for example via:
- the theme settings, if it supports custom header scripts,
- a plugin for inserting code into the header,
- Google Tag Manager, if you already use it,
- editing the template through a developer.
The important thing is that the CMP script is loaded before the marketing and analytics scripts it is meant to control.
Step 3: run the cookie scan
Once the script is in place, you run the scan. Cookienovo goes through the site and identifies the cookies that are set on a visit.
A scan typically finds:
- the cookie name,
- the domain,
- the provider,
- the category,
- the expiration,
- the technical purpose,
- whether it is a first or third party.
The result is not just a list of names, but the basis for a cookie declaration.
Step 4: check the categories
Automatic classification is fast, but we recommend checking it. Some cookies are clearly necessary, others analytics or marketing. For unclear cookies you need to look at which plugin or service sets them.
Example:
- WooCommerce cart: usually necessary cookies,
- Google Analytics: analytics cookies,
- Meta Pixel: marketing cookies,
- YouTube embed: often a third party with a marketing or functional impact,
- reCAPTCHA: a security/functional service, depending on how it is used.
Step 5: adjust the cookie bar texts
The cookie bar should be short and easy to understand. You do not need to list all cookies in the first layer. You need to say which categories you use and why.
Example:
We use cookies for the site to work, to measure traffic and to improve advertising. We will only use analytics and marketing cookies with your consent. You can change your settings at any time.
In the second layer the user then sees the details.
Step 6: verify blocking
This is the part that is often forgotten. It is not enough that the banner exists. You need to verify that after clicking "Reject all" the optional scripts do not run.
With WordPress the problem is often that some plugins insert scripts directly into the HTML or via their own hook. If the CMP cannot catch them, they may run before consent.
That is why we recommend a test:
- open the site in an incognito window,
- reject the optional cookies,
- check the cookies in the browser,
- check the network requests,
- compare the state after giving consent.
Step 7: set up a regular rescan
Cookie compliance is not a one-time thing. A WordPress site changes. Plugins, campaigns, embedded videos and advertising tools are added.
That is why a regular rescan makes sense. If a new cookie appears, you can classify it, add it to the declaration and adjust the blocking.
Deploying to WordPress via the official plugin
Once you have your cookies scanned and the declaration ready, all that is left is to get the cookie bar onto the site. On WordPress the easiest option is to use our official Cookienovo plugin — you download it, upload it via Plugins → Add New → Upload Plugin, paste your site code and you are done.
The plugin inserts the script into the <head> in the right order and sets up Google Consent Mode v2 before the Google tags, so you do not have to edit the template or deal with script order. You will find the guide for downloading and installing it in the WordPress documentation.
Conclusion
You can scan a WordPress site quickly. What usually takes the most time is not the scan itself, but the decision about what to do with the cookies you find.
Cookienovo helps you with both parts: it finds the cookies and prepares a cookie declaration from them that a visitor can understand.
Run a scan of your WordPress site in Cookienovo and find out what cookies you really use.
Recommended sources:
- GDPR art. 12 and 13: https://eur-lex.europa.eu/eli/reg/2016/679/oj
- CJEU judgment Planet49 C-673/17: https://curia.europa.eu/juris/document/document.jsf?docid=218462&doclang=EN
---
