The Cookies tab has two jobs: finding what is on your site, and keeping the list your visitors read.
Scanning your site
Press Scan my site now. The scanner fetches up to twelve of your own pages the way a stranger would, with nobody signed in: your home page, your blog page, your WooCommerce shop, cart and checkout pages if you have them, and your most recently updated pages and posts. It names the service behind each third-party script and embed, and reads the cookies your server sets.
The results list each Service, its Group, how many Cookies there are to add, and the pages it was Seen on. Tick the ones you want and press Add the ticked cookies to my declaration. You can edit every one afterwards. The scan also lists cookies your own server set that are missing from your declaration, and any pages that could not be read, usually because of a firewall or a password-protected staging site. Those reasons show even when nothing could be read at all. A scan stops after about 25 seconds, so a server that blocks the site from loading its own pages can never leave the screen hanging.
What the scanner cannot do
It reads HTML. It does not run your pages in a browser, so a cookie that only appears after a script runs, or after somebody presses play on a video, is found through the built-in dictionary of what each service sets. You can always add a row by hand.
Your cookie declaration
This is the list shown in the choices panel and on your cookie policy page. Each row has a Cookie name, Group, Set by, Expires and What it does. Use Add a cookie for a new row, Remove to delete one, then press Save the declaration. The list starts with WordPress's own cookies and this plugin's own cookie already filled in, plus cookies from sister plugins such as WP Conversion Tracker when they are active.
A name ending in a star covers a family: a row of _ga_* covers every _ga_ cookie Google creates on your site. To show the list anywhere, use [rxc_cookie_table], or [rxc_cookie_table category="analytics"] for one group.
Tracker Watch
Once a week the site is scanned again and compared with every tracking service ever seen on it. When a service turns up for the first time, you get one email and a Dashboard alert headed Tracker Watch found something new, naming the service and the page it was seen on. A service is reported once, even if it sits on an older page that only some scans read. Nothing is added to your declaration for you. The very first scan only sets the baseline, and a scan that could not read any of your pages compares nothing and alerts nobody: Check now says so plainly instead of saying nothing is new. The switch (on by default), the Send the alert to address and a Check now button are on the Settings tab.