By default the audit sees what a logged-out visitor sees. If the pages you want audited sit behind a login — a members area, a store locked to account holders — you can hand one run your session cookie, and the crawler presents it while crawling your domain.
Use this when the pages that matter are invisible without a session. Don't use it to audit someone else's account area, and don't paste a cookie for a site you're not auditing — the cookie is only ever sent to the audited domain, so it would do nothing anyway.
Crawl behind a login
To audit pages behind a login:
- Log in to your site in your browser.
- Copy the request Cookie header for your session: in your browser's dev tools, go to
Network→ any request to your site →Request Headers→cookie. - In the setup wizard, open
Advancedand paste it intoCrawl behind a login. - Run the audit normally.
Logged-in pages will appear in the report like any other page. If they're missing, the cookie either expired before the crawl or didn't carry the session — see below.
Limits and usage
- The cookie applies to one run only. It's never stored, never written to logs, and never shown back to you. Rerunning the audit means pasting it again.
- The cookie is capped at 4,096 characters and is only attached to requests to the audited domain and its subdomains. If a page redirects off your domain, the cookie is dropped for that hop — it can't leak to a third party.
- Rendering with JavaScript also carries the cookie, so client-rendered members areas work too.
If something isn't working
Members pages still show as login redirects. The session likely expired — sessions on many sites are short. Log in again, copy a fresh cookie, and rerun immediately.
The cookie is rejected on paste. It's over the 4,096-character cap. Copy only the cookie header value, not the whole request; strip analytics cookies if you must — the session token is the part that matters.
Only some members pages were crawled. The crawler still discovers pages through your sitemap and internal links. Members pages that nothing links to are invisible regardless of the cookie.