Website Cookie Scanning

In Short

BigID’s Website Cookie Scanning helps you discover and manage all tracking technologies used on your website, including cookies, beacons, and scripts. It scans your entire site and subdomains, classifies most trackers automatically, and provides tools to review, edit, and export the data.

Access: Cookies & Trackers > Scanner

Add a domain to scan

Add a new domain from the + New button at the top-right hand side of the page:

1. Enter the URL to scan.

   Tip

   For best scanning results, and to prevent errors, don’t include the “http://” or “www” parts of the URL.

   For example, instead of: http://www.example.com, enter example.com

2. Select whether the URL is a Production or Test environment.

3. When you click Save, BigID automatically scans the URL.

How It Works

After adding a domain, BigID performs a multi-layered scan that detects:

• Cookies (first- and third-party)

• Beacons

• Scripts

Most tracker are automatically classified (e.g., Necessary, Marketing, Statistics) and enriched with metadata like vendor, expiration, and detection path.

For each tracker discovered, BigID classifies and enriches most of them with key metadata, including:

• Tracker type and ID

• Hostname

• Description

• Vendor (when identifiable)

• Classification (e.g., Necessary, Marketing, Statistics, Preference)

• Expiration period

• Path

Intelligent Crawling

BigID’s scanner emulates real browsing behavior. Starting from the domain you entered, it loads pages in a browser-like session, clicks through the links it finds, and builds a sitemap of your site as it goes. Trackers (cookies, beacons, and scripts) are detected on every page the scanner visits.

The scanner:

1. Starts at the root domain you entered (for example, bigid.com).

2. Follows internal links recursively to discover deeper pages, building a sitemap of the site.

3. Includes subpaths and subdomains it finds through those links.

4. Stays within the same domain. External links are not followed or scanned.

Example

When scanning bigid.com:

* Upcoming enhancements will let you add extra URLs to be scanned, including pages that aren’t linked from your site, and exclude specific subdomains and subpaths from a scan.

Note: Pages that aren’t linked. The scanner discovers pages by following links, so it can only reach pages that are linked from the main site or from one of its subdomains or subpaths. A page that nothing links to, such as a standalone landing page, can’t be reached and isn’t scanned. Pages behind a login can be scanned by enabling Scan beyond login.

Scanning Behavior & Timeline

Scans typically take between 5 minutes and 2 hours, depending on site complexity, number of links, and amount of embedded content. By default, a scan runs for up to 1 hour. Most trackers are classified automatically using BigID’s tracker database. Any left unclassified can be classified afterwards (see Classify Cookies & Trackers).

Tips for successful scans:

• Domain format: Enter your domain without https:// or www.

  • Correct: bigid.com

  • Incorrect: https://bigid.com, www.bigid.com

• Private or restricted sites: If your site is behind a firewall or access-restricted, allowlist the BigID scanner IPs so the scan can reach it.

• Production vs. Test: Add each environment as its own domain so test trackers don’t mix with production results.

Deep Scan (Configure Scanner)

For large or complex sites, you can give the scanner more time to crawl, so it reaches deeper pages and finds more trackers. Scanner settings are available after the domain’s first scan has finished.

To configure the scanner:

1. Open the domain and go to the Scanner tab.

2. Click Actions > Configure scanner.

3. Set the options you need, then click Save.

Tip: If a scan finishes with fewer pages or trackers than you expect, increase the Duration and run the scan again.

Cookies & Trackers Management

After a scan is complete, BigID provides a comprehensive dashboard and management tools for reviewing and organizing your trackers.

The visual dashboard includes:

• Total trackers by type (Cookies, Beacons, Scripts)

• Total trackers by classification (Necessary, Marketing, etc.)

• Filters and search options for deeper exploration.

Classify Cookies & Trackers

BigID automatically classifies most trackers during the scan. For any remaining unclassified trackers, you can complete the classification in one step. To do this, select multiple trackers and choose the “Classify” option to assign a classification in bulk. You can also classify individual trackers by clicking the edit option next to each tracker.

Edit Cookies and Trackers Details

You can edit or complete the information of any cookie or tracker at any time. To do this, click the edit (pencil) icon next to the tracker you want to update.

The following fields can be modified:

• Classification category

• Vendor name

• Expiration duration

• Description in each language

This helps ensure that your consent banners and compliance reports display accurate and complete information.

Your edits are preserved. Any cookie, beacon, or script that you modify in any way (its classification, vendor, description, expiration, or any other field) is kept exactly as you set it. Re-scans do not overwrite it. See Re-scan the Site.

Re-scan the Site

To keep your website compliant and up to date, performing regular scans is essential. With BigID, you can:

• Manually initiate a new scan at any time by clicking the spinning refresh icon.

• Enable Monthly scan from Actions > Configure scanner.

These options ensure that any changes to your site’s trackers are continuously monitored and reflected in your dashboard.

What happens to your edits on a re-scan

Re-scanning, whether automatic (monthly) or manual, never overwrites the changes you made:

• Modified trackers are kept as-is. If you changed a cookie, beacon, or script (for example, reclassified it from Statistics to Marketing, or edited its vendor or description), it keeps the updated classification and all its other data after a re-scan.

• Modified trackers stay even if the scanner no longer finds them. If a tracker you edited is no longer detected on your site, it is not removed.

• Untouched trackers are updated by the scanner. For trackers you haven’t modified, the scanner updates their information and whether they still exist on your site.

The principle is simple: if you modified a tracker, you know your website or mobile app better than the platform does, so your changes take priority.

Export Cookie Data

You can export the entire tracker dataset as a CSV file. The file includes:

• Tracker ID

• Hostname

• Classification

• Vendor

• Expiration

• Path (URL where it was first found)

Check Cookie Paths

Each tracker record includes the exact path or page where it was first detected (for example: bigid.com/discovery-foundation). This helps pinpoint where a specific script or cookie is injected into your site.

You can view this information by:

• Opening the tracker details and clicking Edit, or

• Enabling the Path column in the dashboard to see all tracker paths in one place.

Add a Cookie or Tracker Manually

BigID detects most trackers automatically during a scan, but you can also add them by hand. Adding a tracker manually is useful when:

• A few trackers sit behind a login. If you know that only one or two cookies are set on authenticated pages, and you prefer not to set up Scan beyond login, you can add those cookies manually.

• A tracker only fires after a very specific user action. Some trackers are set only in rare situations that a scan can’t reproduce. These are uncommon cases, but BigID lets you add them so your inventory stays complete.

To add a tracker, click + Add Tracker at the top of the Scanner page and complete the following fields:

• ID: Enter a meaningful ID for the tracker so you can identify it easily in the table.

• Hostname: Enter the hostname of the tracker. For example, https://example.com.

• Description: Describe the tracker and its purpose. English is selected by default, but you can change the language of the description to any of the supported languages using the dropdown.

• Details: Select the tracker’s Classification, whether Opt out applies for the US, the Service that hosts the tracker, and the number of hours before the tracker expires.

• Wildcard match: Select this option to find cookies that only partially contain the tracker’s ID.

• Type: Select whether the tracker is a Cookie, Beacon, or Script.

Whitelist IPs for Cookie Scanning on Private or Firewalled Sites

If your website is not publicly accessible, such as being behind a firewall or access-restricted network, you must whitelist specific IP addresses to enable BigID Website Cookie Scanning. Only add the IPs for the region corresponding to your environment.

Production – United States (bigidcmp.cloud)

Whitelist the following IP addresses:

• 52.54.216.172

• 52.86.109.206

• 107.20.227.117

Production – Australia (au.bigidcmp.cloud)

Whitelist the following IP addresses:

• 16.176.80.89

• 16.176.66.93

• 13.55.100.16

Production – Indonesia (in.bigidcmp.cloud)

Whitelist the following IP addresses:

• 16.78.116.180

• 108.137.49.11

• 16.78.118.35

Note: This step is only required if your site cannot be reached publicly. If your website is internet-facing and unrestricted, no action is needed.