Is your tracking first-party?
We fetch the page from our server and list every script it loads — first-party or third-party, which vendor, and what each one costs you when a blocker is on. Then we check the one thing almost nobody has: a durable, server-set first-party visitor id.
A real request from our server, following redirects. No signup, no simulation.
durable identity = first-party AND server-set
Third-party scripts are dropped by ad blockers before they run — that is roughly 20–30% of paid traffic. First-party scripts survive blocking, but a first-party cookie written by JavaScript is still capped at 7 days in Safari.
Both properties are required. Most sites have neither.
The four states your tracking can be in
| Setup | Survives ad block | Survives ITP | Verdict |
|---|---|---|---|
| Third-party tag (GA4, Meta pixel) | No | No | Blind on ~25% of paid traffic, 7-day memory on the rest |
| Third-party cookie | No | No | Blocked outright in Safari and Firefox |
| First-party script, JS-set cookie | Yes | No | Runs everywhere, forgets everyone after a week |
| First-party script, server-set cookie | Yes | Yes | The only configuration that actually measures |
Related: cookie & storage inspector · ITP loss estimator · first-party vs third-party, in plain English
Frequently asked questions
What does first-party mean here?
A script or cookie served from your own domain rather than someone else's. Third-party requests are the ones ad blockers, tracking protection and enterprise proxies drop — and they drop them by domain, before your code ever runs.
Why does third-party matter if I only use Google and Meta?
Because those are the two most-blocked domains on the internet. On paid traffic, 20–30% of sessions never load them at all. Your tracking is not slightly noisy on those sessions; it is completely absent.
Does first-party mean ITP-proof?
No, and this is the distinction most people miss. A first-party cookie written by JavaScript is still capped at 7 days in Safari. What makes it durable is being set by a server in an HTTP response. First-party is necessary; server-set is what makes it survive.
Why do you see fewer scripts than my browser does?
We read the HTML your server returns. Tags injected later by a tag manager, a consent banner or a framework hydration step will not appear. That is itself informative — anything injected by a third-party loader dies with that loader.
Is my URL stored?
The URL is used for the scan and rate limiting. We do not publish scans, and nothing is shared.
What should a healthy setup look like?
Few or no third-party scripts on the critical path, a durable server-set first-party cookie holding the visitor id, and conversions confirmed from your backend. That combination is immune to both ad blocking and ITP.
Move your tracking onto your own territory.
Flowsk runs first-party, sets the visitor id from your server, and confirms conversions from your backend — so neither an ad blocker nor Safari gets a vote in whether you can measure your ads.
More free tools
Same deal — instant, no signup.