Website privacy & tracking scan
One server-side GET: Set-Cookie headers, third-party URLs from the HTML, a few header checks, and lazy pattern matches in the markup. Post-load JS can still add worse stuff — this is just a snapshot.
GDPR notes below are shorthand for humans, not a legal opinion.
What it’s ok for
Quick inventory of first response: who’s in the HTML, what cookies drop early, whether obvious headers exist.
What it’s bad at
No JS execution, no logged-in view, no A/B/geo. Regex hits can lie. Don’t use it as a compliance certificate.
GDPR / ePrivacy blurbs
Those lines under findings are rule-of-thumb reminders (consent, Art. 13, transfers, etc.) — skim or ignore.