Scheduled scanning: automatic tracker monitoring (Pro & Agency)

A consent setup is only as good as its awareness of what’s actually running on your site — and sites change. A new plugin quietly adds a pixel; a theme update embeds a video player; a marketing colleague pastes in a tag. Scheduled scanning re-runs the CoreConsent scanner automatically and emails you when something changes, so drift gets caught in days instead of at your next manual audit.

Turning it on

In Settings → CoreConsent, the controls sit in a strip at the top of the Scan results panel:

1. Tick Scan automatically.
2. Pick a frequency — Daily, Weekly (the default), or Monthly. Weekly is right for most sites; choose Daily if plugins and tags change often on yours.
3. Optionally enter a recipient email. The grayed address you see before typing is a placeholder, not a saved value — it shows your WordPress admin email (Settings → General → Administration Email Address), which is where reports go if you leave the field blank. Type an address only to send reports somewhere else, such as a shared inbox.
4. Click the strip’s own Save button. These three settings save from this strip — not from the page’s main Save button — and you’ll see a green “Saved.” confirmation.

The first scheduled scan runs shortly after saving.

What lands in your inbox (and what doesn’t)

The email policy is deliberately quiet — reports are meant to be signal, not noise:

• First scan: a baseline. One email confirming scheduled scanning is active, listing everything currently detected. This is your “it’s working” receipt.
• After that: changes only. You get an email when a tracker appears (“New trackers detected”, with a pointer to the scan panel — a newly installed plugin is the usual culprit) or disappears (“No longer detected”). The email lists only what changed, never the full inventory again.
• All quiet: a monthly check-in. If nothing changes, one short email a month confirms scans are still running and found nothing new. Silence would be ambiguous — this way, no email for five weeks means something’s worth checking, not “probably fine.”

On white-labeled Agency installs, the emails carry your brand name in the subject and heading, so clients receiving reports never see CoreConsent mentioned.

Email delivery

Reports are sent with WordPress’s standard mail function, so they use whatever your site already uses — PHP mail, your SMTP plugin (WP Mail SMTP, FluentSMTP, etc.), or your host’s relay. If the baseline email lands in spam or doesn’t arrive, the fix is the same as for any WordPress email (order receipts, password resets): set up an SMTP plugin with a proper sending domain. That’s a site-level improvement worth making regardless.

“Does my host support this?” — yes

Scheduled scanning rides on WordPress’s scheduling system, and it’s built to be reliable across the two ways hosts run it:

• Managed hosts (Pressable, Kinsta, WP Engine, and similar) fire WordPress’s scheduler on a real server-side timer. Scans run on schedule with no setup.
• Traditional hosts trigger the scheduler on page visits, so a very quiet site could run a scan late. CoreConsent self-corrects: whenever an admin visits the dashboard, it verifies the schedule exists and — if a scan is badly overdue — runs it right then.

Either way, there’s nothing to configure on the hosting side.

FAQ

What counts as a “change”? A tracker appearing in or disappearing from the scan results. Changes to an existing tracker’s status (for example, you configure it as a service) don’t trigger an email — you did that yourself.

I enabled it but got no email. The baseline email arrives after the first scheduled scan, which runs within minutes of saving on most hosts. Check spam, and confirm the site can send email at all (does a password-reset email arrive?). If not, see the SMTP note above.

Can I still scan manually? Absolutely — the Scan site button works exactly as before. Manual and scheduled scans share the same results table.

Does scanning slow down my site? No. The scan fetches your homepage the way a first-time visitor’s browser would, once per scheduled run — it’s a single background request, not something that runs on visitor traffic.

What happens if my Pro license lapses? Scheduled scanning pauses with the other Pro features and resumes when the license is active again. Your settings are kept.

Agencies: can each client site report to a different address? Yes — the recipient is per-site. Set each client site’s field to the right inbox (yours or theirs), and remember the emails are white-label branded when White Label is enabled.