Cookie Scanner

Premium feature.

The scanner answers the question that comes before every cease-and-desist letter: does my shop set cookies that never appear in the banner?

Running a scan

1. Select the sales channel.
2. Scan shop now.

The scan fetches the start page of the sales channel, collects up to five representative internal pages — preferring category, product, cart and checkout pages — and evaluates their Set-Cookie headers. In addition it adopts all cookies registered through the Shopware CookieProvider. The result is stored and stays visible on the next visit.

Reading the result

Known cookies

Cookies that match a configured entry. The list also shows which cookie name produced the match.

Unknown cookies

Cookies without a matching configuration — they do not appear in the banner and they are the actual reason for scanning. If the built-in cookie database recognises the cookie, provider, purpose and lifetime are suggested right away. Two options:

• Add automatically — creates the entry with the suggested data in the matching group.
• Configure manually — opens the creation form under Cookies & Scripts.

Scanned pages

Lists the URLs that were actually fetched — useful to verify that the right page types were covered.

What the scanner does not find

Cookies that are only set after consent by external scripts — for example GA4 or Meta — are captured neither by the header scan nor by the inventory automatically.

That is not a gap but a consequence of how it works: the scan fetches the pages passively over HTTP, without a browser and without consent. A script that is blocked at that moment logically sets no cookie that could be observed. A header scan likewise cannot see cookies that are set by JavaScript in the browser.

You have to record those cookies yourself. The quickest route is Cookies & Scripts → Add preset: the presets for GA4, Meta, Hotjar, Matomo and others already carry the cookie names.

Manual cross-check: accept everything in your browser, open the developer tools under Application → Cookies and compare the list with your configuration. Whatever is there and missing from the banner needs to be added.

Further limits:

• If no domain is configured for the sales channel, nothing can be scanned.
• The scanner only follows internal links on the same domain.
• Landing pages that are not linked from the start page are never reached.

Automatic weekly scan

Enable Scan the shop for cookies weekly in the plugin configuration. The scheduled task prems_cookie_consent.cookie_scan then runs every seven days and the result appears on this page. It requires a running message consumer — see Scheduled Tasks.