Privacy laws like GDPR and the ePrivacy Directive require that you get consent before setting non-essential cookies, and that you clearly link a privacy policy. This checker looks for a consent banner, checks whether tracking cookies fire before consent, and inspects your cookie security flags.
WPDoctor scans your live site and reports the compliance gaps that could expose you to fines or complaints — along with what to fix.
Privacy laws like the GDPR and the ePrivacy Directive set a simple principle: don't set non-essential cookies (analytics, advertising, tracking) until the visitor has given informed consent, and clearly tell people what you collect via an accessible privacy policy. 'Informed consent' means a real choice — not a pre-ticked box or a banner that tracks you the moment it appears.
This checker inspects your live site for the signals that show whether you're meeting those basics.
The single most frequent failure is a consent banner that's purely decorative — it shows a message but analytics and ad scripts have already loaded before anyone clicks anything. Declining should genuinely stop those trackers, not just hide the banner. Other common gaps are a missing or hard-to-find privacy policy, and tracking cookies set without any disclosure at all.
This checker flags cookies that fire before consent so you can see whether your banner is doing its job or just providing false comfort.
Use a consent solution that actually blocks non-essential scripts until the visitor accepts, publish a clear privacy policy and link it from the banner and footer, and make sure your cookies carry the Secure, HttpOnly and SameSite flags. Keep a record of what each cookie does so your disclosures are accurate.
This tool provides a technical compliance snapshot to fix the obvious gaps — for your exact legal obligations, confirm with a qualified professional for your jurisdiction.
If you serve visitors in the EU/UK (or similar regions) and use non-essential cookies like analytics or ads, then yes — consent is generally required before those cookies are set.
No. This is a technical compliance check that flags common issues. For your specific legal obligations, consult a qualified professional.
Cookie security attributes: Secure sends cookies only over HTTPS, HttpOnly blocks JavaScript access, and SameSite limits cross-site sending — together reducing hijacking risk.
Cookies strictly needed for the site to function (like login sessions) generally don't need consent; analytics, ads and tracking cookies do.
Requirements vary by region, but many privacy laws are extraterritorial and apply based on who visits you. If you have any EU/UK visitors, or use ad/analytics cookies, a consent mechanism is the safe default.
In regions covered by GDPR/ePrivacy, analytics cookies are generally non-essential and require consent before they load. Your consent banner should actually block them until the visitor accepts.