Scheduled scans, login areas and click paths

A statement describes a state. Every new page, every new image and every theme update can change it. With a scheduled scan you learn about it from the report rather than from a complaint.

Scheduled scans

In the website’s “Testing” tab, under “Test on a schedule”, choose the “Interval”. The page then shows the date of the next scan.

A verified domain is required. Nothing is scheduled for a website above your plan’s limit.

What happens after a scheduled scan

• Owners and administrators receive an email: how many findings are new, how many are fixed, how many remain open – and whether only part of the pages could be evaluated.
• If the result differs from your published statement, the statement is marked as outdated, and the email says so: Versions, “outdated” and PDF.
• Assessments and answers to manual checks carry over. New manual checks can be added: Answering the manual checks.

Login areas

The most serious barriers are often not on the home page but in the customer account or checkout. Add a login under “Login areas” for these.

• Create a separate test account – not your own login and not one with administrator rights.
• You enter the address of the login page, the selectors for username, password and submit, and a success marker: a selector that only appears after a successful login.
• The credentials are stored encrypted, only decrypted during a scan and masked in screenshots. Every access is logged and visible to you.

Number of logins: 1 in Starter, 5 in Business, unlimited in Agency.

Click paths

Some states cannot be reached through an address – for example a form showing an error message. A click path describes the steps to get there; the scan checks after every step.

• Allowed steps are goto, click, fill, select, press, wait_for, assert_visible and scroll.
• Nothing is ever ordered, paid, deleted or logged out: buttons with such labels are not clicked.
• For ordering and payment flows, “Stop before” is required – the selector of the button before which the path stops.

Number of click paths: 3 in Starter, 15 in Business, unlimited in Agency.

Login areas and click paths require a verified domain – that is the line between a testing tool and an attack tool.