Scan Impact

Application Scanning sends simulated attacks to your web application, so a scan can have side effects. The settings on this page help you keep that impact under control.

Custom Request Limit

Custom request limit is under Scan preferences > How fast can we go? in the scan profile settings.

By default there is no limit: the scan runs as fast as possible with the resources Detectify gives it. Most sites don’t need a limit.

If your application slows down or becomes unavailable during scans, turn on Enable request limit and choose a value under Requests per seconds. You can choose 5, 30, 50, 90 or 100, or 200 to 1000 in steps of 100. The limit applies per origin, meaning each combination of protocol, hostname and port.

A lower limit makes scans take longer. If the limit is very low, the crawler can time out on a loading screen before the page renders, so it never finds the links and inputs on the page. This looks like a slow site, when the limit is the cause.

If a scan affects your application’s performance, that can itself be a sign that the application is vulnerable to denial-of-service (DoS) attacks.

Buttons and Actions with Side Effects

The scanner tests every button it finds. If a page has a button that deletes all your data, the scanner will press it. To prevent this:

• Scan a test environment, or log in with a test account that holds no data you need.
• Don’t use admin credentials when you scan a production environment.
• Add pages with destructive actions to Avoid paths/URLs.

Contact Forms

If you have contact forms that send emails or create issues in your ticketing system, a scan may submit them, sometimes several times. To prevent this, you can:

• Add the URL of the form to Avoid paths/URLs.
• Block form submissions from Detectify in your application code or WAF. You can identify Detectify’s requests by the source IP addresses or the user agent.

If the scanner can flood your contact form, anyone else can too, so that can be a vulnerability in itself.

Next Steps

• Optional Features — Form filling and other optional tests
• Paths and URLs — Keep the scanner away from parts of your site
• Settings — All scan profile settings