New Scan & Settings

Use New scan to define how a scheduled scan should run for a website, including scan frequency, rate limiting, and the URLs to be audited. (Scans were previously called scan configurations.)

Open the New Scan Screen

To create a new scan:

• Click Sites in the sidebar
• Click Scans on the website's card (or open the site and choose Scheduled scans)
• Click New scan

This opens the New scan screen. Creating scans is available to admins and power users.

Each existing scan has three tabs: Runs, URLs and Settings. The Settings tab holds the same form described below; the URLs tab is where you add and manage the scan's pages.

Scan Settings

The form is organized into sections, in the order you'd decide on them:

• Basics - Scan name
• Schedule - Frequency and Rate limit
• Standards - organization scanning rules, or this scan's own WCAG 2.2 AA and WCAG AAA rules
• Authentication - sign the scan in first when pages sit behind a login
• Cookies - cookies the scan sets before it loads each page (collapsed; its header shows how many are set, for example "2 cookies")
• Advanced - Proxy (collapsed; its header shows the current proxy setting, for example "Proxy: Use organization proxy")

All sections are saved together. A bar at the bottom of the page stays in view while you scroll, with Cancel and Create and continue (for a new scan) or Save changes (for an existing scan); it also tells you when you have unsaved changes. If you try to save while a required field is empty, the cursor moves to that field, opening its section if needed.

Basics and Schedule

• Scan name (required) - A descriptive name for the scan.
• Frequency Choose how the scan should run:
  • On demand - Scans are started manually by the user. Once the scan is created, it can be run immediately or triggered multiple times, but no scans run automatically.
  • Daily - All enabled URLs in the scan are scanned once per day automatically.
  • Weekly - All enabled URLs in the scan are scanned once per week automatically.
  • Monthly - All enabled URLs in the scan are scanned once per month automatically.
• Rate limit Controls how many pages per second the scan requests, to avoid overloading servers or tripping a firewall:
  • 10 scans / second (default)
  • 5 scans / second
  • 1 scan / second
  • 1 scan / 5 seconds
  • 1 scan / 10 seconds
• Infrastructure & Firewall Configuration - If your website is protected by a firewall, Cloudflare, or other security filtering, you may need to allowlist QualiBooth’s Scheduled Scanning IP addresses to prevent scans from being blocked. You can open the “View scanning IP addresses” link (next to the rate limit) to see the current IP addresses used by QualiBooth Scheduled Scanning infrastructure. This is typically required only for websites with strict security restrictions.

Changing the frequency of a scan that is currently running asks you to confirm, because it stops the running scan.

Standards

Control additional accessibility scanning behavior for the scan, including enabling WCAG 2.2 rules and AAA rules. By default, Use organization settings is checked and the scan follows the organization's Scanning rules. Uncheck it to turn Enable WCAG 2.2 AA and Enable WCAG AAA on or off for this scan only.

Proxy Settings (Optional)

Under Advanced, Proxy controls whether this scan uses a proxy server for Scheduled Scanning.

• Use organization proxy (default) - Uses the proxy configured under Settings → Proxy. If not set, the scan will run without a proxy.
• No proxy - Runs the scan without a proxy
• Use custom proxy - Uses a dedicated proxy configured specifically for this scan

When using a custom proxy, provide:

• Server URL
• Proxy username (optional)
• Proxy password (optional)

Authentication (Optional)

If the pages you want to scan are only visible after signing in, Authentication lets the scan sign in first, so your pages are audited the way a logged-in user sees them instead of showing the login screen.

Three options are available:

• No authentication (default) - The site is scanned anonymously.
• Form login - QualiBooth signs in through your login page before the scan starts. Provide the Login page URL, Username and Password. The sign-in form is detected automatically, and single sign-on providers are supported.
• HTTP Basic - QualiBooth answers the browser's built-in sign-in prompt, common on staging environments. Provide only a Username and Password.

Passwords are stored encrypted and are never displayed back to you - the field shows a fixed mask, so you can change other settings without retyping the password.

For Form login, the address you provide must open directly onto a visible sign-in form. Forms that appear only after a click (a pop-up, modal, tab or expandable section), two-step logins, two-factor authentication (2FA/MFA) and CAPTCHA-protected login pages cannot be completed by a scan. If your form uses non-standard field names or custom components and is not detected automatically, optional selector overrides are available under Advanced — override automatic detection.

Note: HTTP Basic cannot be combined with a proxy that requires its own username and password. If both are configured, a message explains the conflict and the scan cannot be saved until one of them is changed.

For full setup instructions, advanced options and troubleshooting, see Authentication.

Cookies (Optional)

Cookies are set in the browser before every page in the configuration is scanned. Typical uses:

• Dismiss a consent banner - set the cookie your consent tool stores once a visitor accepts, so the banner never covers the page being audited
• Scan as a signed-in user - carry an existing session cookie, as an alternative to Authentication when the site cannot be signed in to through a form

To add a cookie, expand Cookies, click Add cookie and enter its Name and Value. Use the trash icon next to a cookie to remove it. A configuration can set up to 50 cookies.

Each cookie is sent only to the host of the page being scanned, so no domain, path or expiry is needed.

Cookie values are stored securely and are never displayed back to you. For a saved cookie the value field starts empty: leave it empty to keep the stored value, or type a new value to replace it. If you rename a saved cookie, enter its value again - the stored value is kept by name and does not move to the new name. Users without permission to manage the configuration see only the cookie names.

Cookies must be valid for a browser, otherwise the configuration cannot be saved:

• Name - letters, digits and the characters !#$%&'*+-.^_`|~; no spaces. Each name can appear only once.
• Value - printable ASCII characters other than ;. URL-encode anything else (for example spaces or non-Latin characters).
• Length - name and value together must be 4,096 characters or fewer.

Tip: To find the cookie your consent banner uses, accept the banner in your browser and look under the site's cookies in the browser developer tools (for example Application → Cookies in Chrome). Common examples are OptanonAlertBoxClosed (OneTrust) and CookieConsent (Cookiebot).

Click Create and continue to save the new scan. Its URLs tab opens next, so you can add the pages to scan.

Add/Import URLs

URLs are managed on the scan's URLs tab (admins and power users). A maximum of 10,000 URLs can be added/imported per scan. You can add URLs using multiple methods:

Add URLs Manually

• Click Add URL
• Enter one or more URLs
  • URLs can be separated by comma, semicolon, or new line
• Click Add

All successfully added URLs are enabled for scanning by default.

Fetch Home Page URLs

• Click Fetch Home Page URLs
• QualiBooth crawls the homepage and discovers internal links one level deep.
• A modal opens displaying all fetched URLs Note: A maximum of 100 URLs can be imported using this method. If more URLs are discovered, only the first 100 are displayed and available for import. In the modal:
• All URLs are selected by default
• You can select or deselect individual URLs (or all of them at once)
• Click Add selected URLs to configuration

If no URLs are found, a message is displayed.

Import Sitemap

• Click Import Sitemap and enter your sitemap URL
• All valid URLs belonging to the same domain are imported
• Invalid or external URLs are skipped Note: A maximum of 10,000 URLs can be imported using this method.

Import CSV

• Upload a CSV file containing one URL per line
• Column headers (if present) are ignored
• Multiple CSV files can be imported (one at a time) Note: A maximum of 10,000 URLs can be imported using this method.

During import:

• A loading indicator is shown
• Other actions are temporarily disabled

After import, a summary message shows:

• Number of URLs imported
• Number of URLs rejected (invalid, wrong domain)
• Number of duplicate URLs ignored

Managing URLs

Each scan contains at least one URL by default (the site’s base URL). The URL list below the add controls provides full control over scan inclusion:

• Each URL has an Enabled switch — disable a URL to skip it without deleting it
• Bulk actions are available when URLs are selected:
  • Enable selected
  • Disable selected
  • Delete selected
• Delete all removes every URL after confirmation
• Individual URLs can be deleted using the trash icon
• Pagination options: 25, 50, 100 or 200 URLs per page
• Search is available to filter URLs

Only URLs belonging to the same domain (including subdomains) can be added.

All changes take effect immediately - no additional save action is required.

At the top of the URLs tab, you can see both the total number of URLs added and the number of URLs currently enabled for scanning.

Starting or Activating a Scan

A primary action button is available at the right of the scan's tab bar (and in the row of the scans list) once the scan is saved and URLs are added.

The button behavior adapts dynamically:

• Activate scan - For new scheduled scans or such that are inactive
• Deactivate scan - For active scheduled scans
• Run scan now - For On demand scans
• Stop scan - For On demand scans with a scan currently running

If no URLs are added, the action button is disabled with a hint to add URLs first. A scan cannot be started without at least one configured URL.

Returning to the Scans List

Use Scheduled scans in the breadcrumbs or in the sidebar to return to the list of the site's scans.