Sites, schedules and staging logins
Crawl rules, scan schedules, deploy hooks and scanning sites behind a login.
Updated
Crawl rules
- Start URL: where the crawl begins.
- Sitemaps:
/sitemap.xmland anySitemap:lines in robots.txt are read automatically. - Include and exclude: path globs to focus on parts of the site.
- robots.txt is respected, using the user agent
RonguAccessWatchor*.
At most two pages of a site load at once.
Schedules
| Option | When it runs |
|---|---|
| Weekly | The default for every site |
| Daily | With the Daily scans add-on |
| Deploy hook | After each release, from your CI |
| Scan now | Whenever you click it |
To use a deploy hook, create one on the site page and call the URL from your pipeline with a POST request. Keep the URL secret.
Staging sites behind a login
Two options, which can be combined:
- HTTP basic auth: a username and password.
- A login script: simple steps such as
goto,fill,clickandwaitFor. No code is run.
Passwords are stored encrypted.
Alerts
When a scan finds new critical or serious problems, owners and admins get an email, and a Slack message if you added a Slack webhook.