Cookie Manager: scanning, categorising and publishing your cookies

Cookie Manager is the inventory behind your banner. It's where CookieLet's scanner reports every cookie it found on your site, where you sort those cookies into categories, and where you publish the result so your banner's preference centre and cookie declaration stay accurate. This article covers each part of the page in the order it appears.

Opening Cookie Manager

Select the website from the Website selector at the top of the sidebar, then choose Cookie Manager.

The page has three areas: the Banner Overview strip at the top for running and scheduling scans, a Cookie List tab showing your categories and cookies, and a Scan History tab showing past scans. The Publish Changes button in the top right pushes edits live; it stays greyed out until there's something unpublished.

Banner Overview

Last successful scan and Scan Now

The left card shows when the scanner last completed a run. Select Scan Now to start a fresh scan immediately.

A confirmation appears and the button changes to Scanning… while the crawl runs. Small sites finish in a minute or two; larger sites take longer, depending on how many pages your plan allows per scan. You can leave the page — the results appear in Cookie List and Scan History when the scan completes.

Run a scan whenever you add a new tool to your site — a chat widget, an analytics platform, an embedded video — or after a redesign. Anything that sets cookies you haven't categorised will land in Other and won't be governed correctly until you sort it.

Next scan and Schedule Scan

The right card shows whether a recurring scan is set up. Select Schedule Scan to configure one.

• Frequency — Weekly or Monthly. Weekly is available on higher plans; Monthly is the default recurring option.

• Select date — the day of the month (for Monthly) or the day of the week (for Weekly) the scan runs on.

• Time (UTC) — when it runs. All scan times are in UTC. Pick an off-peak hour for your audience so the crawler doesn't compete with real visitors.

The summary line beneath the fields confirms the schedule in plain words. Select Schedule scan to save it. The Next scan card then shows the upcoming run.

Cookie List

The Cookie List tab is split in two. Categories are on the left; the cookies in the selected category are on the right.

Categories

Each category card shows its name and how many cookies it holds. Select a card to see its cookies. The pencil icon renames the category or edits its description; the bin icon deletes it.

Two categories appear on a fresh site:

• Functional — cookies that make the site work and remember preferences. Comes with a ready-written description that appears in your banner's preference centre.

• Other — where the scanner puts cookies it couldn't classify automatically. It has no description and should be empty by the time you publish.

The category description is customer-facing. It's the text shown next to the toggle in your preference centre, so keep it short and plain. If you rename a category, keep the name consistent with the labels in your Cookie Banner content settings.

Add Category

Select Add Category to add one of CookieLet's predefined categories:

• Strictly Necessary — required for the site to function; can't be refused

• Functional — preferences, language, session convenience

• Security — authentication and fraud prevention

• Performance — load balancing, speed measurement

• Analytics — usage statistics such as Google Analytics

• Marketing — campaign attribution and email tracking

• Advertising — ad networks, retargeting, ad personalisation

• Social Media — share buttons and embedded social feeds

• Other — anything that doesn't fit

Each comes with a default description you can edit. The categories you add here are the ones your visitors see as toggles in the preference centre, so add only the ones you actually use — a banner with nine toggles for a site that sets five cookies looks careless.

Analytics, Advertising and Functional categories are also what drive your Google Consent Mode signals. See the Google Consent Mode article for how each category maps to Google's consent types.

The cookies in a category

The right-hand panel shows the category's name, its description, an + Add Cookies link, and a Discovered cookies table with four columns:

• Cookie ID — the cookie's name as set by the browser

• Domain — the domain that set it. Your own domain means a first-party cookie; anything else is third-party

• Duration — how long it persists before expiring

• ⋯ — the row menu, for editing the cookie's details, moving it to a different category, or removing it

A worked example: sorting what the scanner found

The screenshots in this article come from a small site where the scanner found five cookies. Here's how they should be handled.

In Functional:

• XSRF-TOKEN — first-party, 4 days. A cross-site request forgery token that protects forms and logged-in actions from being triggered by another site. It's essential for the site to work safely, so Functional is correct. If you've added a Strictly Necessary or Security category, it belongs there instead.

In Other, waiting to be sorted:

• zenler_detected_country_code — first-party, 1 year. Stores the visitor's detected country so the site can localise content and currency. This is a preference cookie: move it to Functional.

• tracking_uuid — first-party, 1 year. A persistent unique identifier assigned to the visitor. A cookie that identifies a person across visits for a year is tracking by definition, regardless of who set it: move it to Analytics or Marketing, depending on what the site uses it for. It must not stay in a category that loads without consent.

• __Secure-YNID and __Secure-ROLLOUT_TOKEN — third-party, .youtube.com, 6 months. Both are set by embedded YouTube players and are used by Google to identify the viewer and control feature rollout. They belong in Advertising (Google's own classification for YouTube embed cookies) or at minimum Social Media. Once categorised, CookieLet blocks the YouTube embed until the visitor consents.

Why Other has to be emptied. Cookies left in Other are not governed by any consent toggle. Depending on your legislation preset they may load before consent, which defeats the purpose of the banner — and it's the first thing a regulator or auditor checks. Sorting Other is the single most important job in Cookie Manager.

Adding a cookie manually

The scanner can't see everything. Cookies set only after login, only on specific user actions, or only in regions the scanner doesn't crawl from won't appear automatically. Add them by hand with + Add Cookies inside the relevant category.

Required fields

• Cookie ID — the exact name, such as _ga. Case-sensitive.

• Domain — the domain that sets it. A leading dot (.example.com) means the cookie is shared across subdomains.

• Expiry Date — when the cookie expires. For session cookies use today's date; the declaration will show it as a session cookie.

• Script URL Pattern — the domain or path of the script that sets the cookie, such as google-analytics.com. This is what CookieLet uses to block the script before consent. Get this right or the cookie will be declared but not actually blocked.

• Description — what the cookie is for, in plain language. Shown in your cookie declaration.

Advanced options

• Value — an example value, useful for identifying the cookie in an audit. Never enter a real visitor's value.

• Path — the URL path the cookie applies to. Default is /, meaning the whole site.

• SameSite — the cookie's cross-site policy: Strict (never sent on cross-site requests), Lax (sent on top-level navigations only), or None (always sent; requires Secure).

• HTTP Only — the cookie can't be read by JavaScript. Typically true for session and security cookies.

• Secure — the cookie is only sent over HTTPS.

These attributes appear in your cookie declaration. If you don't know them, open your site in the browser's developer tools, find the cookie under Application → Cookies, and copy the values from there.

Select Save draft. The cookie is added to the category but not yet live.

Publish Changes

Every edit in Cookie Manager — recategorising, renaming, adding or removing cookies, changing a description — is a draft until you select Publish Changes. Publishing updates three things at once:

• the toggles and descriptions in your banner's preference centre

• your cookie declaration, if you've embedded one on your site

• the blocking rules CookieLet applies before consent

Changes reach your site through the CDN within a few minutes. Publish after every sorting session; a scan that finds new cookies doesn't publish anything by itself.

Scan History

The Scan History tab lists every scan CookieLet has run for this website, newest first:

• Scan Date — when it ran, in UTC

• Scan Status — finished, or the failure reason if the crawler couldn't complete

• URLs Scanned — how many pages the crawler visited, up to your plan's limit

• Categories and Cookies — what it found

• More Info — opens the detail view for that scan

Comparing two rows is the fastest way to spot a change. In the example, the July scan covered 2 URLs and found 4 cookies; the September scan covered 12 URLs and found 9. The extra cookies came from pages the first scan never reached — which is exactly why you should check that the URLs Scanned figure covers your whole site.

The notice above the table is worth taking seriously: no scanner sees everything. Cookies set behind logins, on checkout, or by scripts that only fire on certain interactions need a manual check. Follow the link in the notice for how to do that with your browser's developer tools.

Scan detail

Select More Info to see one scan in full. The summary strip shows the date, total cookies, total categories and URLs scanned. Beneath it, Scanned URLs lists every page the crawler visited and how many cookies it observed there.

Use this list to answer two questions:

• Did the scan reach everything? If important pages are missing, they may be blocked by robots.txt, behind authentication, or beyond your plan's page limit.

• Where do the cookies come from? Pages with a higher count are where third-party embeds or tools live. In the example, pages with 9 cookies are the ones containing an embedded video; pages with 4 only carry the site's own cookies.

Select Back to return to the list.

Recommended routine

1. Run a scan, or wait for the scheduled one.

2. Open Other and sort every cookie into the right category. Add categories if you need them.

3. Add any cookies you know about that the scanner missed.

4. Check that every category has a description your visitors will understand.

5. Select Publish Changes.

6. Open your site in a private window, reject all cookies, and confirm in developer tools that only the Necessary and Functional cookies are set.

Frequently asked questions

The scanner found fewer cookies than I expected

Check the URLs Scanned count against your site size. If pages are missing, you've likely hit your plan's page-per-scan limit, or the pages are behind a login the crawler can't pass. Scanning behind authentication isn't supported; add those cookies manually.

A cookie disappeared from the list after a rescan

Cookies that no longer appear on any scanned page are dropped from the inventory, on the assumption the tool that set them was removed. If it's still in use on a page the crawler didn't reach, add it manually.

Can I rename "Functional" to something else?

Yes, with the pencil icon on the category card. Keep the name recognisable — visitors have learned what "Functional" and "Analytics" mean, and unusual names lower consent rates.

I published but the preference centre still shows the old categories

Clear your site's cache and test in a private window. Your own browser may be holding an earlier consent state with the old category list.

Still need help?

Email support@cookielet.com with your website URL and the name of the cookie you're unsure about, and we'll tell you where it belongs.