# Website check: cookies, accessibility, security | konformia > Free website check: trackers before consent, the reject button, accessibility, security and email, for shops the checkout. Fixes in the free 14-day trial. Source: https://konformia.at/en # Check your website: cookies, accessibility and security. Measured like a visitor, with the fix for every point. Plus your domain's email settings, and for shops the path all the way into the checkout. For websites with visitors from the EU. Check your website for free Your account after the first check Sample shop. Every point opens its fix with the steps for your tool. example-shop.eu Checking … 8 to fix, 15 notes - Consent & cookies checking 8 to fix - Checkout & product pages checking 8 notes - Accessibility checking 2 notes - Dark patterns checking 1 note - Data flows & servers checking 3 notes Most important point **Google Analytics 4 loads without consent** **Fix:** In Google Tag Manager, open the GA4 tag and set “Additional consent required” under Advanced settings. Result for a made-up demo shop **14 days free, no credit card.** Results in under two minutes, no access or plugin needed. 56 % ## of EU websites we checked load trackers before anyone consents. A banner that shows up does not hold anything back yet. We note every service and every cookie from the first request, then click “Reject” and measure again, confirmed with an ordinary browser. 57 % **load Google Fonts from Google’s servers before anyone consents.** The fonts usually come with the theme, past the banner. The report shows the source and the fix, in the WordPress plugin with one click. 848 websites, 14 EU countries, November 2026, hits re-checked by hand. [Method and numbers](https://konformia.at/en/cookie-study) ## A fix for every point. Then every week. ### The steps for your tool Where a service comes from (plugin, theme, app or Tag Manager) and what to set in your consent tool. **Order button without words like “order with obligation to pay”** quick fix Label the last button before submitting the order unambiguously, for example “Order with obligation to pay” or “Buy now”. `Order with obligation to pay` to copy Checked like a visitor, no access and no plugin: - **Home page** - **Category** - **Product page** - **Checkout** ### Email only when something changes If a plugin update loads a new tracker, you get an email with where it is and the fix. Example for a made-up shop k**konformia.at** ### example-shop.eu: 1 new point since the last check We checked example-shop.eu again. Something was added since the last report. New since the last check **Meta Pixel loads without consent** No longer found Hotjar loads without consent Open the full report The report sits at a random address and is excluded from search engines. Only people with the link can see it. konformia.at measures what your website does technically. Not legal advice. Servers in the EU · Legal notice · Privacy · Unsubscribe ## 16 checks for websites in the EU market 4 of them only for shops, all the way into the checkout. Every plan includes all of them. ### All 16 checks with reference | Check | Where it shows | Basis | | --- | --- | --- | | **Does a tracker load before consent?** | Home page and subpages | Art. 5(3) Directive 2002/58/EC (ePrivacy) | | **Accessibility: statement and purchase path** | Home, category, product page, checkout + own page | Directive (EU) 2019/882 Art. 4 and 13, WCAG 2.1 AA | | **Does the reject button really work?** | Home page, after a click on Reject | Art. 5(3) Directive 2002/58/EC (ePrivacy) | | **Unit price, shipping costs, delivery time** | Only on the product page | Art. 3 Directive 98/6/EC, Art. 6(1) Directive 2011/83/EU | | **Order button label** | Only in the checkout | Art. 8(2) Directive 2011/83/EU | | **“Withdraw from contract” button** | Every page | Art. 11a Directive 2011/83/EU, since 19 June 2026 | | **Cancellation button for subscriptions** | Every page, subscriptions only | § 312k BGB, Germany only | | **Dark patterns: countdowns, pre-ticked add-ons, late fees, changed cart contents** | Home page, product page, checkout | Annex I No. 7 Directive 2005/29/EC, Art. 22 Directive 2011/83/EU | | **Pre-ticked consent boxes** | Every form | Art. 4(11) GDPR | | **Which country the services keep their servers in** | Name resolution (DNS), no page | Art. 44 GDPR | | **Trackers under your own address (CNAME cloaking)** | Name resolution (DNS), no page | Art. 5(3) Directive 2002/58/EC, Art. 5 GDPR | | **Google Consent Mode, duplicate banners and tag managers** | Home page | Art. 5(3) Directive 2002/58/EC (ePrivacy) | | **Visible keyboard focus and accessibility widgets (overlays)** | Home page, with the Tab key | Directive (EU) 2019/882, WCAG 2.1 criterion 2.4.7 | | **Email sender (SPF, DKIM, DMARC) and certificate expiry** | Name resolution (DNS) and connection | technical, no legal duty | | **Security headers, libraries with known vulnerabilities, session cookies** | Home page | technical, no legal duty | | **Broken links and images** | All visited pages | technical, no legal duty | ## 14 days free. After that you pay for the repetition. Every plan includes every check. The price depends on domains, not on pages. ### Watchdog 29 € a month 1 website - checked every week - email when something changes - “Continuously checked” badge [Compare all plans](https://konformia.at/en/pricing) ### Agentur 99 € a month 25 client websites - everything in Watchdog - every report as a PDF for the client file - link for clients without an account [For agencies](https://konformia.at/en/agencies) IS ## Who builds konformia I’m Immanuel Schranz, 25, a software engineer from near Vienna. During my computer science studies I first came across data protection, cookie consent and accessibility. Out of my own interest I wrote a small tool that checks what a website loads before you agree to its cookie banner. The result surprised me: many websites had a banner, and the trackers loaded anyway. With every website I tested, new questions came up. Does “Reject” really work? Is the checkout accessible? Are the domain’s email settings correct? Step by step, the small tool became konformia, now with 16 checks and a fix for every finding. I build and run konformia myself. The servers are in the EU, and I answer your emails personally. **Immanuel Schranz** Founder [hallo@konformia.at](mailto:hallo@konformia.at) - Checked from outside, nothing to install - One price per domain - Not legal advice - [Legal notice](https://konformia.at/en/legal-notice) ## FAQ ### Does the scan work if my website is not in English or German? Yes. The scan reads your website in its own language, in every official EU language: the reject button in the cookie banner and, for shops, shipping costs and delivery time, manufacturer details, the legal guarantee note, the order button with the wording of Art. 8(2) Directive 2011/83/EU and the withdrawal button with the wording of Art. 11a, each in your language. The report and the steps to fix are in English or German. ### What does the scan check before cookie consent? We measure which services load before consent. The yardstick for access to the device is Art. 5(3) of the ePrivacy Directive 2002/58/EC; whether an exemption applies has to be checked case by case. ### Does konformia check my legal texts? No. We do not check legal notice, privacy policy or terms; legal-text services and lawyers do that. We measure what your website does technically and say how to fix every point. ### Does konformia replace my cookie banner? No. Your banner collects consent. konformia measures independently whether it really blocks: which services load before consent and after “Reject”, and how to stop that in your banner tool. ### Do I get personal help? Yes. You do not write into an anonymous ticket portal but directly to the operator: short questions, answered with the concrete report in view. ### What does the check cost? The check is free: your website and email address start a 14-day trial without payment details that ends by itself. Ongoing watching costs 29 euros a month for one domain (Watchdog) or 99 euros for 25 (Agency), with extra domains in between. A monthly plan cancels monthly, a yearly plan at the end of the paid year. ### Can I check again right after a change? You can start a new check yourself after changes. Within 24 hours you have as many manual checks as your plan has domains, and each domain can be checked manually at most once in 24 hours. Automatic checks do not count. ### Will my result be public? No. The result is in your account, the report behind it at a random address blocked for search engines. Only you and people with your link can see it. ### Why do you need my email address? Your result lives in an account, and an account belongs to an address. You see it right away, without a password. The click in our confirmation email unlocks every fix, the PDF, checking again and the email on changes. Until then we send nothing but that one email, and the trial ends by itself after 14 days. ### My banner shows. Why does something still load? Usually the service is added a second time: hard-coded in the theme, past the banner through pixel settings in the shop or CMS, or as a Tag Manager tag without a consent check. The report names the source of each service and the step in your banner tool. ### Does konformia install anything on my website? No. We check from outside like a visitor, so your website does not get slower. The plugin and the app are optional and only change what you switch on there yourself. ### Does it cost more if my website has many pages? No. The price is per domain, however many pages, products or visitors the website has. Cancel monthly, no extra charges, and the 14-day trial ends by itself. ### Can I show that I check my website? Yes. Your account keeps a check log with the date and result of every check. It shows that and what you checked, not that the website is lawful. ### Does the scan see what my visitors see? Some sites serve a checking tool different code than a browser. Before we report that something loads before consent, we therefore open the home page a second time like an ordinary browser. We never get around bot protection: blocked means blocked, and the report says so. ## A check usually takes under two minutes. Free, no credit card. The trial ends by itself. Check your website for free