Compliance scanning in your terminal.

Install & run

Requires Node.js 18+. No sign-up, no API key, no tracking.

# Install from npm
npm install -g @mahope/eucomply-scanner
eucomply-scanner https://yourdomain.com

# Run without installing
npx github:mahope/eucomply-scanner https://yourdomain.com

# Or clone & run locally
git clone https://github.com/mahope/eucomply-scanner
cd eucomply-scanner && node cli/eucomply.js https://yourdomain.com

All three run the same scanner. It is MIT licensed and the source is on GitHub.

Example output — a real run of this scanner against webflow.com, captured 28 September 2026 from 510,616 bytes of served HTML. Regenerate it from the engine with python3 tools/build_cli_example.py in the GitHub repo; the quality gate fails if the two ever differ.

$ eucomply-scanner https://webflow.com

🔍 EUComply Scan Report for https://webflow.com/
   Platform: Webflow  |  Duration: 67ms
   Score: 3/6 of the checks that apply to this site (50%)

   - not counted: tcf — Not counted here — IAB TCF only applies to a site that runs programmatic advertising in the EEA.

   - not counted: consent_mode_v2 — Not counted here — Consent Mode v2 is only required of a site that runs Google Ads in the EEA.

   - not counted: dora — Not counted here — DORA applies to financial entities, and a public page scan cannot tell whether the operator is one. This scan is not a DORA assessment.

   All 9 checks: 3/9 (33%)

 ❌ No Google Consent Mode v2 detected
    No Consent Mode v2 signals found. Since March 2024, Google requires Consent Mode v2 for ad personalization in the EEA. Without it, Google Ads conversion tracking may be restricted.
    💡 Implement Google Consent Mode v2 with the default consent state for ad_storage and analytics_storage. See https://developers.google.com/tag-platform/security/guides/consent.

 ❌ No IAB TCF detected
    No IAB Transparency & Consent Framework signals found. TCF is used by ad-tech platforms and publishers for GDPR consent management in programmatic advertising.
    💡 If you run programmatic ads in the EEA, implement IAB TCF through your CMP. See https://iabeurope.eu/tcf/.

 ❌ 1 tracker(s) with NO consent platform
    Trackers found in page markup: Google Analytics / GTM. No consent management platform was found — these trackers likely fire before consent.
    💡 EU ePrivacy rules and GDPR Art. 6 require consent BEFORE loading non-essential trackers. Install a CMP that blocks Google Analytics/Meta Pixel etc. until the visitor consents.

 ✅ HTTPS + HSTS OK
    HSTS: max-age=31536000

 ⚠️ No consent banner detected
    No known cookie-consent platform found in the HTML. If you set any non-essential cookies, EU ePrivacy rules require prior consent.
    💡 Add a consent management platform (e.g. one of the open-source options: Klaro, Tarteaucitron).

 ✅ Form(s) found, privacy-policy link detected
    Form markup found and a privacy-policy link was detected in the page HTML.

 ✅ 3 legal pages linked
    Found on page: Privacy / GDPR, Cookie policy, Terms & Conditions.

 ⚠️ 1 security header missing
    Missing: X-Content-Type-Options: nosniff missing
    💡 Add security headers. See https://securityheaders.com for guidance on each.

 ❌ No DORA-related page signals detected
    No page-text references to failover, incident response or continuity were found. This scan does not query DNS or assess DORA compliance.
    💡 Review whether the site publishes useful failover, incident-response and business-continuity information. Verify DNS and regulatory controls separately.

Automated technical checks only — not legal advice. Full compliance review requires a qualified professional.

What it checks

Nine automated technical checks against EU requirements:

Why a CLI?

• CMS-independent — works on WordPress, Shopify, Webflow, Next.js, Squarespace, Wix or hand-written HTML. The scanner only needs a URL.
• CI-friendly — pipe results into your build pipeline and fail deploys when compliance regressions appear.
• Fast — one request to the page (plus a DNS safety check that refuses private addresses), so a scan is sub-second. No agent to install on the target server.
• Honest output — every check prints its verdict, passed, needs a look, failed, with the exact evidence it found and what that means. We never claim legal certainty a script can't have.