Domain scan disclosure

This page explains how OptinStack domain scans work, how subscription tiers affect how many pages we scan, and what you should expect when comparing scan results over time.

It supplements our Terms and Conditions and Privacy Policy. It is not legal advice for your business.

When you start a scan, we first load the registered hostname over HTTPS and follow a normal redirect to its canonical hostname, such as apex to www. We then attempt to load that hostname’s sitemap.xml. If a valid sitemap is available, we extract same-host page URLs listed there.

If the root sitemap is a sitemap index (a list of child sitemap files), we fetch those child sitemaps on the same hostname and merge page URLs from them, subject to published fetch and discovery limits.

If no sitemap is found or it cannot be read, we fall back to crawling links on your homepage over HTTPS.

We filter out URLs that do not match the scanned hostname.

Domain scans are performed against the public hostname registered in your workspace. You are responsible for registering the hostname visitors actually use in their browser.

If your site is served through a reverse proxy, edge worker, CDN, or platform domain mapping, register the public proxy hostname rather than a private origin hostname. OptinStack does not inspect private origin infrastructure unless it is publicly reachable through the registered hostname.

Webflow and Framer development hostnames may receive Free or paid coverage before a production domain is available. Each entitlement includes one self-service reassignment to a registered target; additional changes require review.

The scanner must be able to load the registered hostname over HTTPS. Firewalls, bot protection, authentication walls, geographic rules, rate limits, or other access controls may block scanning or produce incomplete results.

You are responsible for allowing scanner access where needed and for reviewing scan output. OptinStack does not scan logged-in areas, private origins, or pages that cannot be reached through the public site.

Each scan analyzes at most the number of pages allowed by the plan tier for that hostname. That is not a full-site audit unless the number of unique discoverable URLs on your hostname is less than or equal to your tier limit.

The dashboard may show how many pages were discovered versus how many were scanned (for example, “50 of 2,775 pages”) so you can see when coverage is partial.

After discovery, URLs are normalized (for example: HTTPS only, fragments removed, duplicate paths collapsed, and your site root canonicalized to a single homepage URL).

If your homepage is in the discovered set, it is scanned first. We then prioritize common compliance-related paths (such as privacy, cookie policy, and terms pages when present in the discovered set), then sort remaining URLs in stable alphabetical order. We scan up to your tier limit from the start of that ordered list.

For the same discovered URL set and hostname, this produces predictable, repeatable page selection. Free, Pro, Business, and Enterprise use the same ordering; higher plans scan more pages from the beginning of that list.

Scans store tracker inventory in your workspace for review. Live site enforcement updates only when you publish from the dashboard (Publish in the sidebar or Settings).

Published tracker rules reflect only what we detected on pages we actually scanned (plus any trackers you add manually). They do not verify trackers on unscanned pages. You remain responsible for accuracy across your full property.

Re-running a scan on the same hostname with the same tier, before your sitemap or homepage links change, should select the same pages and produce comparable tracker inventory for those pages.

Activating a higher plan adds pages from the same ordered list; the first 50 Free pages remain the first pages in the Business scan set.

Tracker counts and categories can still change between scans even when the same URLs are selected. Reasons include:

Sites with thousands of URLs in a sitemap (for example large location or catalog sites) may have more discoverable pages than your tier allows. We scan an ordered subset after homepage and compliance-path pinning, not the entire sitemap.

If compliance or inventory goals require broader coverage, upgrade to a higher tier, adjust your sitemap and internal linking strategy, or supplement automated scans with manual tracker entries in your workspace.

We scan up to your tier limit from the ordered list described above. Trackers on pages we do not reach in that run will not appear in the scan report or in published configuration until you scan a higher tier or add them manually.

Upgrade to a higher tier to scan more pages from the same ordered list, or add trackers manually for pages outside the scan set.

When your discovered URL set has not changed and you use the same tier, we select the same pages in the same order.

If you add or remove sitemap entries, change homepage links, or upgrade tier, the selected set may change.

Even when the same pages are scanned, trackers can differ if your site loads tags conditionally, third-party resources fail or time out during the scan, or you changed marketing scripts between runs.

A different page set (because the sitemap changed or a different tier was used) will also change totals.

You are responsible for ensuring your consent banner, consent preferences, and policy disclosures reflect trackers in use on your properties.

Automated scans are an aid, not a guarantee of complete detection. Review scan results, investigate unscanned sections of your site, and update configurations when your stack changes.

Questions about scans or tiers: hello@optinstack.com.

Domain scans themselves are deterministic: OptinStack loads pages with automated browsing and matches observed trackers against our curated library. Scan results do not use artificial intelligence.

On Business and Enterprise plans, optional AI-assisted features may send limited technical or styling context to third-party providers when you explicitly request them. Nothing is saved to your configuration until you review and approve it.

For sub-processor questions about Anthropic (Claude) or Google Cloud Translation, contact hello@optinstack.com.

We may improve discovery or selection logic over time. Material changes will be reflected on this page with an updated "Last updated" date.