What your website loads, and what changed since the last scan
Observary scans your pages in a real browser on a schedule, explains each finding in plain words and tells you when something new starts loading before consent.
- Cookies
- Scripts
- Iframes
- Web fonts
- Embedded media
Drift monitoring
Like uptime monitoring, but for consent. Each page is compared with its own previous visit, so a change is a real change and not a different page being scanned.
- Automatic rescans: weekly on Pro, Business and Agency, monthly on Starter.
- Every alert names the script or host, the page, and whether it now loads before consent.
- High-severity drift shows in your Inbox and on the domain’s Drift tab, and sends one email per scan to each team member who has drift emails on.
- After every scan the banner install is checked again. If the snippet disappears or the banner stops showing, that’s a high-severity alert too.
How changes are graded
-
High
A vendor or host started loading before consent that didn’t before.
An alert in the app, and an email to everyone who has drift emails on.
-
Medium
A new tracker that waits for consent but still needs disclosing, or more of a problem you already had.
-
Low
Everything else, including trackers that went away.
Built to avoid false alarms
An alert you learn to ignore is worse than none. These rules keep the Inbox meaningful.
-
“Discovered”, not “new”
Trackers on pages scanned for the first time are labelled discovered, so scanning more of your site doesn’t look like drift.
-
Removed means removed
Nothing is reported as gone until every page it was seen on has been rescanned twice without it, or 90 days have passed.
-
One Inbox for every domain
Filter by severity, mark several as read at once and archive for yourself. The drift history itself is never deleted.
Scanning in a real browser
Chromium loads each page twice: once as a new visitor who hasn’t chosen, once as a visitor who clicked “Accept all”. Everything that loads is recorded, first-party and third-party, with what loaded it.
- Findings are matched to a vendor and category from a catalog Observary maintains, with cookie purposes from the open-source Open Cookie Database.
- Sites that delay JavaScript until the first interaction, such as with WP Rocket, Perfmatters or LiteSpeed, are handled by simulating mouse movement and scrolling.
- Results from the most important pages appear while the rest of the scan continues.
What a scan records
- Cookies_ga, _fbp
- ScriptsTags and pixels
- IframesWidgets, maps
- Web fontsFrom other servers
- MediaEmbedded video
Fonts matter too. Loading a web font from another company’s server can pass on visitor data, a known issue in the EU with hosted Google Fonts.
Which pages get scanned
The whole site, over time, not just the homepage. The app tells you how often your plan covers every page.
-
Sitemaps and page types
Observary reads robots.txt and your sitemaps, including nested and compressed ones, groups pages into types and checks one of each type on every scan.
-
Pinned pages
Pages you always want checked, like checkout or a campaign landing page: 10, 25 or 50 per domain, depending on your plan.
-
Rotation
The rest of the site takes turns, so over several scans every page is covered. Up to 50, 150 or 500 pages per scan.
-
Exclusions
Leave out parts of the site that don’t matter, such as /wp-admin/* or /tag/*.
-
Your own hosts
Declare your other hostnames, like an image CDN, so they count as your own. Changes are kept in an audit trail.
-
Scan now
Manual scans on top of the schedule: 3, 10, 50 or 150 a month, depending on your plan.
Findings, score and fixes
Each finding is marked compliant, a violation (it needs consent but loads before it) or unclassified. A score per domain, with its history, shows whether things are getting better.
- “Needs attention” lists the most important issues in plain words, each with its fix.
- “Your path to compliance” turns them into a short checklist.
- Filter findings by status, consent timing, category, type and classification.
When you know better than the catalog
Owners and managers can reclassify a finding. The record of who decided what, and why, stays.
-
Manual classification
Set the category and mark it “manually classified” or “accepted risk”. A written justification is required.
-
Append-only history
Every decision is kept, with its author and reason. Accepted risks show as their own status and are left out of the score.
-
Drift still watches
A classification changes the display and the score, never drift detection. If a classified tracker changes, you still get the alert.
Reports and export
Something to send to a client, a manager or your DPO, and your data to take with you.
- Owners can export every domain’s consent log, report and CSVs at any time, including after a subscription stops.
- Reports are in English.
| Export | What’s in it |
|---|---|
| PDF report per domain | Score, what needs attention with fixes, score history, 30 days of drift, all findings |
| Findings CSV | Every finding for the domain |
| Classifications CSV | Every manual classification, for an auditor or DPO |
| Consent log CSV | Every consent decision within your retention period |
Team
Three roles, and everyone decides for themselves whether they want drift emails.
-
Owner
Everything
Including changing roles, managing other owners and renaming the organisation.
-
Manager
Almost everything
Everything except changing roles, managing owners and renaming the organisation.
-
Member
Read-only
Can look at everything and change nothing.
Good to know
- The scanner checks public websites only, not intranets or staging sites behind a login.
- Trackers hosted on your own domain are harder to recognise automatically and may need manual markup.
Fix it once, then keep an eye on it
The consent banner is set up from what the scan finds, on every plan. See consent management.