Review/Free privacy scanner (single page)/No. 5 of 10
Webbkoll review
A free, open-source web check from Sweden that lists one page’s cookies, third-party requests and security headers.
In this article
Webbkoll began as a project of the Swedish association Dataskydd.net and has been run by the non-profit 5th of July Foundation since September 2024. It costs nothing. It opens a single page in Chromium, without clicking or consenting to anything, and lists each request together with the third-party host and its country, first- and third-party cookies and their attributes, use of localStorage, trackers known from Disconnect’s list, HTTPS redirection, and security headers including HSTS, Content Security Policy and Referrer Policy, adding advice and GDPR references. There is no crawling, no consent-banner testing and no reading of policies, and the code repository has been archived.
01In detail
Webbkoll, Swedish for “web check”, entered public beta in May 2016. Dataskydd.net, a Swedish data-protection association, built it with early funding from the Swedish Internet Foundation and released a major update in 2018. After Dataskydd.net dissolved in May 2024, the 5th of July Foundation, a Swedish non-profit, took over in September 2024. Requests to the old address, webbkoll.dataskydd.net, are redirected to webbkoll.5july.net.
You give it one URL. It loads that page in Chromium with a fresh profile, never clicks, scrolls or accepts anything, and then reports: every request, with first- and third-party hosts and the countries of their IP addresses; cookies and their HttpOnly, Secure and SameSite flags; whether localStorage is used; trackers matched against Mozilla’s version of Disconnect’s list; whether HTTP is redirected to HTTPS; and an assessment of HSTS, Content Security Policy, Subresource Integrity, Referrer Policy and X-Content-Type-Options, drawing partly on Mozilla’s HTTP Observatory. Each result is explained, with recommendations and references to GDPR articles and recitals.
Since it never interacts with the page, Webbkoll only sees the state before consent and cannot tell what happens after “Reject” or “Accept”. Privacy-policy content, imprints, e-shop duties and accessibility are outside its scope, and its own about page cautions that a good result does not mean everything is in order. Its authors present it as a starting point for web developers.
There is no charge and no account. The interface is in English, German, Italian, Norwegian and Swedish. Results stay in memory for 24 hours, and the operator says neither URLs nor IP addresses are logged. It has no API, export or monitoring. The code is MIT-licensed and can be self-hosted, but the Codeberg repository was archived on 25 April 2025 as no longer maintained, and the news page records no feature changes since January 2023.
No free tool shows more clearly what a single page loads before consent and how well its security headers are configured.
02What it checks
Of the 7 areas we track, Webbkoll’s published materials cover 2: cookies in browser storage and third-party trackers. It does not check consent banner behaviour, the privacy policy, the imprint, e-shop consumer information or accessibility.
What it inspects
- Cookie and storage scanYes
- Consent banner behaviourNo
- Tracker and third-party request detectionYes
- Privacy policy reviewNo
- Imprint (legal notice) checkNo
- Consumer-law information (e-commerce)No
- Accessibility checkNo
What you get
- Exportable evidence reportNo
- Fix guidanceYes
- Continuous monitoringNo
- Consent management platform includedNo
- Certificate or sealNo
Languages: EN, DE, IT, NO, SV (interface). Countries covered: Any website; GDPR references.
03Pricing
Webbkoll is a free web form that needs no account, and no paid tier is published. The code is open source under the MIT licence and can be self-hosted.[2]
Prices as published by the vendor, checked in . Source: webbkoll.5july.net/en/about. Prices change; check the vendor’s page before you buy.
04How it scores
Webbkoll ranks No. 5 of 10 in our 2026 ranking, with an overall score of 6.3 out of 10 (Good). The table shows the score on each criterion and the weight it carries; the method is explained on how we review.
| Criterion | Weight | Score bar | Score |
|---|---|---|---|
| Breadth of legal checks | 25% | 2.6 | |
| Quality of evidence | 20% | 7.0 | |
| Guidance on fixing | 15% | 5.5 | |
| Fit for European law | 15% | 7.0 | |
| Clear prices and value | 15% | 10.0 | |
| Time to first result | 10% | 9.0 | |
| Weighted overall | 100% | 6.3 |
05Pros and cons
What we like
- No cost and no account, run by a non-profit foundation
- Lists every third-party request with its host and country, and cookies with their HttpOnly, Secure and SameSite flags
- Assesses security headers such as HSTS, Content Security Policy, Subresource Integrity and Referrer Policy, with advice and GDPR references
- Respects privacy in its own operation: results stay in memory for 24 hours and, according to the operator, URLs and IP addresses are not logged
- MIT-licensed open source that can be self-hosted, with an interface in five languages
What could be better
- Looks at a single page and does not crawl
- Because it never clicks or consents, banner behaviour and tracking after “Reject” go untested
- Privacy-policy content, the imprint, consumer-law duties and accessibility are not checked
- The code repository was archived on 25 April 2025 and is marked as no longer maintained
- Offers no API, export or monitoring
06Verdict
Our score: 6.3/10Good
No free tool shows more clearly what a single page loads before consent and how well its security headers are configured. Treat it as a developer’s diagnostic, not a compliance check: it tests no consent states, reads no legal texts, and its code is no longer maintained.
Best for: Developers and privacy-conscious site owners who want a fast, free view of what one page loads before consent and how its security headers are configured.
07Sources
Every factual statement in this review is taken from the pages below. Where a page did not state something, we say “not published” rather than guess.
- Webbkoll (webbkoll.5july.net)
- About (operator, limits, licence) (webbkoll.5july.net)
- News (version history) (webbkoll.5july.net)
- Source code (archived) (codeberg.org)
- 5th of July Foundation (5july.org)
Sources checked in .