Cookies let websites remember who you are between requests, but they also power advertising and cross-site tracking. Privacy regulations such as the ePrivacy Directive increasingly require site owners to know exactly which cookies their pages set and why. The problem: many administrators, developers and compliance teams simply don't have that information.

The usual solution is a crawler that visits every page and collects cookies as it goes. That approach falls apart for sites behind authentication or strict security rules, where scanner bots need special exemptions that can widen the attack surface. And doing it by hand through a browser's developer console only scales for simple, mostly static pages.

What Page Shield Cookie Monitor does

Page Shield Cookie Monitor, rolling out to all paid plans over the next few weeks, replaces scanning with passive observation. If Page Shield is already enabled, no configuration or extra tools are needed. The feature shows every first-party cookie your sites use in a single dashboard, including cookies set by third-party snippets embedded in your pages.

The dashboard lists cookies with their name, domain, path and the host that set them. You can filter by domain or path, which matters if you run different properties — a marketing site and an authenticated admin console, for example — under the same account. A CSV export is available for offline inventory work. Clicking a cookie opens a detail page with all its attributes plus first-seen and last-seen timestamps and pages, mirroring what Script Monitor and Connection Monitor already offer.

There's also a new alert type for newly observed cookies. Subscribers get notified by email or webhook the moment a new cookie appears, with the same detail as the dashboard, so compliance workflows can kick off automatically.

How detection works

Say you run an e-commerce site at example.com. When a user logs in, your server sends a Set-Cookie header like login_id=ABC123; Domain=.example.com. Meanwhile, an embedded Google Analytics snippet sets its own first-party cookies, such as _ga=GA1.2; Domain=.example.com; and _ga_ABC=GS1.3; Domain=.example.com;.

Because those Analytics cookies carry a domain matching yours, they're first-party in practice and get sent back to your origin alongside your own cookie. The browser then returns them in one header: Cookie: login_id=ABC123; _ga=GA1.2; _ga_ABC=GS1.3 — three cookies concatenated, even though only one was set by your application directly.

For a site proxied through Cloudflare, the comparison is straightforward. Cloudflare observes one Set-Cookie header during the response — for login_id — but receives three cookies back on subsequent requests. The overlap, login_id, is tagged as set by your website. The same logic applies across all proxied requests, building up a complete picture of the first-party cookies in use without ever touching your origin's security posture.

A first step toward privacy compliance

Cookie inventories are foundational to user privacy protections, but they shouldn't require weakening your site's defenses to produce. Page Shield Cookie Monitor turns the job into a single click from an already-enabled service.