Webbkoll review

Webbkoll (Swedish for "web check") went into public beta in May 2016. It was developed by Dataskydd.net, a Swedish data-protection association, with early funding from the Swedish Internet Foundation and a major update in 2018. Dataskydd.net dissolved in May 2024, and since September 2024 the tool has been run by the 5th of July Foundation, a Swedish non-profit foundation. The old address webbkoll.dataskydd.net redirects to webbkoll.5july.net.

A test takes a single URL. Webbkoll opens that one page in Chromium with a fresh profile, does not click, scroll or accept anything, and reports what happened: all requests, with first- and third-party hosts and the country of their IP addresses; cookies with their HttpOnly, Secure and SameSite flags; localStorage use; trackers identified with Mozilla's version of Disconnect's list; whether HTTP redirects to HTTPS; and an analysis of HSTS, Content Security Policy, Subresource Integrity, Referrer Policy and X-Content-Type-Options, partly based on Mozilla's HTTP Observatory. Results come with explanations, recommendations and references to GDPR articles and recitals.

Because Webbkoll never interacts with the page, what it sees is the state before consent; how the site behaves after "Reject" or "Accept" is not tested. It does not look at privacy-policy content, imprints, e-shop duties or accessibility, and its own about page warns that a good result does not mean everything is fine. The authors describe it as a starting point for web developers.

The service is free of charge, needs no account and is available in English, German, Italian, Norwegian and Swedish. Results are kept in memory for 24 hours, and the operator says it logs neither URLs nor IP addresses. There is no API, export or monitoring. The source code is MIT-licensed and self-hostable, but the Codeberg repository was archived on 25 April 2025 and marked as no longer maintained; the news page lists no feature changes since January 2023.