Subdomains

Both settings are under Scan preferences > What should we scan? in the scan profile settings.

Allow Crawling to Subdomains

This setting is on by default. During crawling, the scanner follows links it finds to subdomains of the scan profile’s asset and tests those subdomains too, including subdomains it only discovers during the scan.

Turning it off is one way to reduce the scope of a scan that takes too long.

The scan doesn’t go to parent domains. A scan profile for www.example.com doesn’t scan example.com.

Avoid Subdomains

The scan blocks every HTTP request to the subdomains in this list, during both crawling and testing. Subdomains of an avoided subdomain are blocked too: avoiding blog on example.com also avoids tech.blog.example.com.

Enter the subdomain label, such as blog or shop, not the full domain name. This is useful when another scan profile already covers a subdomain.

To keep the scanner away from one path rather than a whole subdomain, use Avoid paths/URLs.

Next Steps

• Paths and URLs — Include and avoid paths
• Settings — All scan profile settings