September 26, 2026 · Updated October 15, 2026
What a free website tracker scan can (and can't) tell you
If a website has a cookie banner, it’s usually because something on the page sets cookies or loads trackers. If it has no banner, the owner often assumes there’s nothing to disclose. A free website tracker scan is the quickest way to test that assumption: you paste a URL and see what the page actually pulls in.
Mitr’s Score my site tool does exactly this. This post explains what the scan looks at, what it can’t see, and what to do with the result, because a scanner is only useful if you know how far to trust it.
What the scan does
You paste a URL at /scan. Within seconds you get:
- A 0 to 100 privacy score for the page.
- The known trackers found in its page source, grouped by type: analytics, advertising, social widgets, support chat and so on.
- A flag on any tracker that sets cookies before the visitor has consented.
It’s free and needs no signup. If you enter your email you get the full report, which names every tracker and explains how to fix each one.
What it can’t see
This is the part most scanner pages skip, so here it is plainly. The scan reads the static HTML of the page. That means it does not see:
- Trackers added later by JavaScript. A lot of tags are injected after the page loads, often by a tag manager. They won’t appear in the source.
- A site’s own first-party analytics. Something the site built and serves from its own domain isn’t recognisable as a known third-party tracker.
So a result that finds nothing means “none of our known trackers were in the page source”. It does not mean “verified clean”. In the tool itself an empty result is shown as inconclusive and not as a pass, because presenting it as a pass would be wrong.
How to read the score
Use it as a prompt to look closer, not as a certificate:
- A low score with named trackers is the useful case. You now have a specific list to act on.
- A high score says the page source looks light. It doesn’t prove nothing else is loading.
- Compare before and after. Run it, make a change, run it again. Seeing the number move is the point.
What to do about what it finds
The full report’s fixes follow a few patterns:
| Tracker type | The usual fix |
|---|---|
| Analytics that needs a cookie | Switch to analytics that needs no cookie and no banner, instead of hiding a cookie-based tool behind consent |
| Support chat widgets | Load them only after a visitor opens the chat, not on every page view |
| Social share and follow buttons | They often load a full tracking SDK just to draw an icon. Use a plain image and link instead |
About consent and the law
If you serve visitors in India, the DPDP Act’s consent requirements are worth understanding, and we’ve written a plain-language piece on what the Act means for an analytics stack. A scan shows what loads on a page at one moment. It can’t establish legal compliance, and it isn’t legal advice. Use it to find and fix the obvious problems, then take proper advice for the rest.
Try it
Paste your own site into Score my site. If the score is lower than you’d like, the quickest single win is usually swapping a cookie-based analytics tool for one that doesn’t need one. Mitr is free for up to 10,000 events a month, with no cookies and no third-party trackers.
Frequently asked questions
Is the Mitr website tracker scanner free?
Yes. Paste any URL at /scan and you get an instant 0 to 100 privacy score with no signup. Entering your email unlocks the full report that names every tracker and explains how to fix each one.
What does the scanner check?
The HTML source of the page you give it. It lists the known trackers it finds, groups them by type, and flags the ones that set cookies before a visitor has consented.
If the scan finds nothing, is my site compliant?
No. An empty result only means none of the known trackers were in the page source. Trackers that load later with JavaScript, and a site's own first-party analytics, are not visible to a static scan, so a clean result is inconclusive, not a pass. A scan is also not legal advice.
What should I do about the trackers it finds?
Remove the ones you don't need, load chat widgets and social embeds only after a visitor interacts with them, and replace cookie-based analytics with a tool that needs no cookie or consent banner.