Website AuditBeta

Inth Website Audit visits your production website and records privacy-relevant runtime behavior. It identifies vendors and cookies, observes scripts, frames, network destinations, and browser storage keys, preserves supporting technical evidence, and highlights changes between comparable scans.

Inth records cookie attributes and storage key names, not their stored values. You do not need to install a snippet on the website.

Use Website Audit to answer questions such as:

• Which vendors and third-party domains were observed?
• Which first-party and third-party cookies were set?
• Which detections could not be matched to a known vendor?
• Which vendors are new or no longer detected since a comparable scan?
• Which pages and scan conditions completed successfully?

Website Audit is a point-in-time observation of the pages it can reach. It is not proof that an unobserved vendor, cookie, or behavior does not exist.

Before you start

You need an Inth project and the full public URL of the production website. The site must be reachable without signing in.

Public policy pages are optional but recommended. Add pages such as your privacy policy, cookie policy, terms, or subprocessor list so the audit can preserve them as policy evidence.

Add a website

1. In the Inth dashboard, open Audit.
2. Open the project that owns the website.
3. Under Websites, select Add website.
4. Enter the production origin, including https://.
5. Add any public policy pages.
6. Choose which pages to scan and save the website.

Each website belongs to a project, so its runtime evidence can be reviewed alongside the related repository and policy context.

Inth saves the website origin rather than a single page path. Use URL rules to include or prioritize particular pages.

Choose pages to scan

Website Audit supports four crawl modes:

• Sitemap and linked pages provides the broadest coverage and is the best default for most sites.
• Linked pages only is useful when the sitemap is missing or out of date.
• Sitemap only is faster but cannot discover pages omitted from the sitemap.
• Only the URLs I list scans only the URLs configured in the website's URL rules.

You can refine a crawl with URL rules:

• Start from seeds the crawl with important pages.
• Limit to prevents the audit from leaving selected paths.
• Never scan excludes sensitive or irrelevant paths such as /admin.
• Scan first prioritizes pages that should be visited before the page limit is reached.

Rules can only target the website's own origin. A page limit can still prevent a listed URL from being visited, so check the completed coverage in every report.

Verify the domain

If Inth asks you to verify ownership, open Domain verification for the website. Depending on your DNS provider, you can:

• use the available one-click connection
• add the displayed DNS TXT record
• serve the verification value from the displayed /.well-known/inth-verify.txt URL

After publishing the record or file, select Check verification. Keep the verification record in place because Inth rechecks it periodically.

The first manual scan may be available before verification. Verify the domain to continue running audits when verification is required.

Configure policy and vendor context

In the website's settings, keep policy-page URLs current and add URL rules when the default crawl is too broad or too narrow.

You can also add affiliated domains that your organization owns. Without that context, requests to your own secondary domains can appear as unidentified or third-party vendor evidence.

Run an audit

1. Open the project Audit page.
2. Find the website and select Run audit.
3. Follow the active run from Audit → History.
4. Open the completed run to review its results.

A Website Audit uses Inth Credits. Credits are reserved when the audit starts. If the balance is too low, the dashboard offers a top-up before retrying the same audit.

Only one audit can run for a website at a time. Crawl breadth, site size, and site performance affect how long the audit takes. Credits reserved for a failed or cancelled audit are released.

Review the results

The report has four views:

• Overview shows coverage, unidentified detections, and vendor changes when a comparable scan exists.
• Vendors lists identified vendors, their categories, where they were observed, and supporting evidence.
• Cookies separates first-party and third-party cookies and links them to known vendors where possible.
• Review contains detections that Inth could not confidently attribute to a vendor.

Open Technical evidence when you need the supporting page, request, script, cookie, or storage details.

Vendor changes are shown only when a prior scan has comparable configuration and completed coverage. Incomplete, blocked, page-limited, or truncated coverage must not be treated as proof that a vendor or cookie is absent.

Coverage and limitations

Website Audit scans public, same-origin pages that its browser can reach. Authentication, bot protection, navigation failures, crawl limits, and slow pages can reduce coverage.

The current audit observes the site's default page state. It does not select accept or reject in a consent banner, compare several consent choices, or prove that consent enforcement works in every region. Treat the report as runtime evidence for review, not as a compliance certification.