Almost any public website can be scanned. A few situations need a moment's thought first.
What we need
A web address we can reach from the internet, serving pages to an ordinary visitor. That is genuinely all.
Sites that need a login
We scan your site the way an anonymous visitor sees it. Anything behind a login will not be reached, so a members area, a customer dashboard or a checkout that requires an account will not appear in your results.
This matters because the pages behind a login are often the ones people use most. If those pages are important to you, get in touch about an expert audit, which can cover them.
Staging and development sites
You can scan a staging site, and it is a sensible thing to do before a launch. Two things to watch. If the staging site is password protected at the server level, we will not get in, so you will need to allow access or scan the live site instead. And if staging differs from production, your results describe staging, not what your visitors actually see.
Sites that block automated visitors
Some sites block anything that looks like a bot, through a firewall, a rate limiter or a service such as a CDN challenge page. If discovery finds nothing, or finds only your home page, this is the usual reason. Ask whoever manages your hosting to allow our scanner, then try again.
Very large sites
Discovery on a site with thousands of pages takes a while, and every plan caps how many pages one scan can cover. That is not a problem, it just means choosing well. Scan the pages that matter most: your home page, your main landing pages, a representative product or article page, and anything involving a form.
Single page applications
Sites that render their content with JavaScript are scanned as a browser sees them, so they work. If your site uses routes that are only reachable by clicking through the interface, discovery may not find them all, and you can expect to do more of the choosing yourself.
Next
If your site fits, go to Creating your account.