Cookiebot Configuration Audit: Test Cookie Blocking

A Cookiebot banner can appear while a separate theme snippet or tag manager loads a tracker. Start by finding the request that creates the cookie, then check how that specific script is controlled. This guide covers configuration QA; for a symptom-by-symptom checklist, see Cookiebot not blocking cookies.

Set up a repeatable audit

Use a fresh browser profile, record the page URL, time, browser and test region, and open Network with Preserve log enabled. Run the free cookie audit for an initial server-browser check. Use the extension for interactive tests in your own browser; region, login and saved choices can produce different results.

Check the loader, scan inventory and manual markup

1. Confirm that the published domain-group ID belongs to this site, including the tested subdomain. Compare the live snippet with the snippet supplied for your blocking mode.
2. For automatic blocking, inspect script order and the latest cookie inventory. Auto-blocking needs to know which resources to block; an unclassified or newly introduced resource needs review.
3. For manually controlled scripts, inspect the inactive script type and data-cookieconsent category. An ordinary executable copy elsewhere in the page can bypass that markup.
4. Check GTM, WordPress plugins and theme code for duplicate analytics installations. Identify which integration owns consent updates before changing triggers.
5. Purge page caches after publishing changes, then test the same URL in a fresh session. Follow Cookiebot’s auto-blocking documentation for loader requirements.

Test the four consent states

Symptoms and next checks

Interpret evidence before reporting a violation

A necessary consent-preference cookie is not equivalent to an advertising identifier. Existing cookies are not necessarily new writes. A Google request under denied consent can be a cookieless ping in advanced Consent Mode; inspect its behavior and your intended configuration with the Consent Mode checker. Classifications are review prompts, not a legal verdict.

Save a reproducible issue

Include the exact URL, clean-session steps, chosen categories, expected result, request or cookie name, initiator and timestamp. For developer handoff use Initiator Trace and a redacted debug snapshot. Repeat the same test after a fix and review any remaining redaction needs before sharing.

Test the HTML that visitors receive, not only the editor preview

A logged-in administrator can receive different HTML from a logged-out visitor. Optimization plugins may delay scripts, a CDN may serve an older template, and an editor preview may bypass the public cache entirely. Record which version you inspected before changing Cookiebot settings.

Compare one failing public URL with a passing URL. Look for the same vendor identifier in both the tag-manager configuration and the page source. The goal is to identify the loading path that escaped the intended gate. A second copy added by a theme or integration can remain active even when the copy you edited is correctly blocked.

Review a category change as a separate test

A visitor who accepts statistics has not necessarily allowed marketing. Choose a partial preference, save it and trigger an action that normally uses each service. Check whether only the intended service starts. Repeat after a reload to see whether the saved selection is handled consistently.

For embedded content, record both the placeholder and the network result. A video thumbnail can be local while the player makes an external request only after interaction. Another integration may connect as soon as the placeholder appears. Describe what your browser observed instead of assuming that all embeds share the same behavior.

When a Cookiebot result looks contradictory

Do not turn a failed scan into a clean result. If the page times out or blocks the automated browser, switch to an authorized browser session and document the limitation. A shorter observation window may also miss delayed work. State the window and interactions used in the report.

Cookiebot setup FAQ

Do I have to use automatic blocking?

Audit the integration method the site actually uses. Automatic blocking, manual controls and tag-manager integrations need different implementation checks. Avoid combining snippets from unrelated instructions without confirming how they interact in your deployment.

Why does a cookie scanner show more entries after acceptance?

Acceptance can start services that were intentionally held back. The important comparison is which category was accepted and whether the new activity belongs to that choice. More entries after a broad grant are not, on their own, evidence that the banner failed.

What do I send to the developer?

Provide the exact URL, clean-session method, selected categories, observed entry and expected behavior. Include a request or script lead if available. The Cookiebot audit checklist covers the full evidence handoff, while the snapshot workflow helps preserve technical context.

For recurring client audits, see the bulk URL scanner and plans and limits. A passing scan describes only the page and conditions observed.