1. Cookie banner snippet (parsed, never executed in this page)
idle
Auto-scan runs on load and 300 ms after typing stops. Parsing uses DOMParser, so nothing in the snippet runs in this document. The reject-all journey loads the snippet into a sandboxed iframe (allow-scripts, opaque origin) whose own meta CSP is default-src 'none': inline handlers run, external scripts, images, frames and connections are blocked. Every blocked request is recorded as a CSP violation and counted below.
2. Findings
| Check | Result | Matched snippet / evidence |
|---|
3. Simulated "Reject all" journey
Not run yet. Press "Run reject-all journey".
4. Observed here, and what needs the live site
Observed in this page
- Nothing yet. Run the journey.
Could not be observed here
- Whether the site or its vendor recorded the rejection (needs a request to a real server).
- Whether third-party tags actually stopped firing on the live site.
- Cookie and storage writes on the site's own origin: the sandbox frame has an opaque origin, so reads and writes there are not the site's.
- Any behaviour implemented inside external scripts, which the sandbox blocks by design.
- What happens on the next page load (banner reappearance, persisted consent record).