Contents
Website compliance scanners compared: what a free scan actually checks (2026)
"Run a free compliance scan" is everywhere. But what do these tools actually test, what can they never see, and when do you need something more than a scan? This guide answers that honestly — including exactly what our own scanner checks and doesn't.
The three layers of compliance checking
| Layer | What it covers | Automated? |
|---|---|---|
| Technical signals | HTTPS/HSTS, security headers, cookie banner presence, privacy policy links, tracking scripts | Fully |
| Behavioural checks | Cookies firing before consent, reject-button parity, third-party trackers | Partially (needs real browser) |
| Legal substance | Whether your policy text actually matches your data practices; records of consent; DPA filings | No tool can judge this |
Any scanner that claims to "make you GDPR compliant" with one click is overselling layer 3. A good scanner does layer 1 reliably, flags obvious layer-2 problems, and tells you clearly where automation ends.
What EUComply's free scan checks
- TLS/HTTPS configuration — certificate validity and HSTS header (GDPR Art. 32 expects appropriate technical measures)
- Cookie consent banner detection — presence of a recognised consent mechanism in the served HTML
- Security headers — Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and friends
- Privacy policy discoverability — whether a linked privacy/cookie policy exists and is reachable
- Platform fingerprinting — identifies your stack so fixes come as copy-paste instructions for your actual setup
Every failed check comes with a concrete fix — not "consult a professional", but the exact header to add or element to change.
How scanners compare to the alternatives
Free automated scans
Best for: a fast triage of the technical layer. Ten seconds per site, zero cost, no installation. Limitation: one snapshot of the homepage — subpages with their own trackers aren't crawled.
Manual audits (consultant)
Best for: legal substance — policy wording, data-processing agreements, consent records, international transfers. Cost: typically €1,500–€10,000+. A sensible sequence is scan first, audit second: arrive at the consultant with the technical layer already clean.
Enterprise monitoring platforms
Best for: large sites needing continuous crawling of thousands of pages. €200–€1,000+/month. Overkill for most SMBs, but the right answer at scale.
Who needs which
| You are… | Sensible setup |
|---|---|
| Freelancer / small business site | Free scan quarterly + generated policies (compliance checklist) |
| Agency managing client sites | Scan every client URL free; buy one $79/year-per-website Pro license for each WordPress site that needs document tools |
| E-commerce / high traffic | Scans + generated docs + periodic human review of policy substance |
Bottom line
A free scan won't make you compliant, but it catches the specific technical failures behind most cookie-related complaints — missing banners, weak TLS, unreachable policies — in seconds and for nothing. That makes it the correct first step for any site, on any platform:
Passed? Add a free compliance badge to your site — client trust plus a dofollow backlink.