> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Run a Security Scan Step by Step

The **New scan** wizard in the Security Center lets you check a host on your domain for vulnerabilities. This article walks you through the four steps and explains credits, scheduling and what happens while a scan runs. For an overview of the Security Center, see "Security Center Overview: Issues, Scans, Domains and Exposure".

## Before you start

- Only company admins can start, schedule and cancel scans. All members can view scans and their results.
- The domain must be verified, monitoring must be on, and **Vulnerability Scans** must be switched on in the domain's **Settings** tab. Vulnerability scanning is off by default.
- Only approved hosts can be scanned. The verified root host is approved automatically; other hosts are approved in the domain workspace.

Open the wizard with **New scan** on the **Scans** page or in a domain's workspace.

## Step 1 – What to scan

![Scan wizard step 1: choose the domain and the approved host](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/scan-step-target_1gk77h0.jpg)


Choose a **Monitored domain** and then one **Approved host**. Domains that need attention – not ready, with open issues or never scanned – are listed first. If a domain is not ready yet, the wizard shows which setting is missing and links to the domain settings.

With two or more approved hosts you can also choose **All approved hosts**. This runs one Expanded scan per host.

## Step 2 – How deep

![Scan wizard step 2: Baseline, Expanded, Authenticated and Deep Active with credits](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/scan-step-depth_1n6pur6.jpg)


| Scan type | What it does | Effect on the host | Credits | Maximum duration |
| ---- | ---- | ---- | ---- | ---- |
| **Baseline** | Safe checks of the host's essentials | Read-only | One per host in each scan period of your plan (daily, weekly or monthly) included, further Baseline scans 5 | 120 min |
| **Expanded** | Broader discovery, ports, crawling and safe tests | Read-only | 30 | 90 min |
| **Authenticated** | Expanded coverage using a login you provide | Signs in, but only reads | 45 | 120 min |
| **Deep Active** | Active tests with explicit authorisation | May create, edit or delete records | 75 | 240 min |

Each card shows the credits left after the scan and a box **What … will not cover**, for example pages behind a sign-in for Expanded scans.

On this step you can also switch on **External port exposure scanning** for the domain. This is a domain setting: it is saved right away and applies to future scans too.

## Step 3 – Access & schedule

### Login details (Authenticated and Deep Active)

An Authenticated scan needs an **Authentication profile**; for Deep Active it is optional. Pick an existing profile or click **Create**. Supported types include browser login (also with SSO and MFA), basic authentication, bearer token, custom headers, query parameter and cookie. Use **Test** to check that the sign-in works – scans that need a verified profile only offer tested profiles.

Secret values are write-only: they are stored encrypted, never shown again and never written to logs. To change a secret, use **Rotate secret**.

For Deep Active you can also attach an **OpenAPI document**, so API operations that crawling does not find are tested too.

### Deep Active authorisation

Deep Active runs against the live system, not a copy. Records may be created, edited or deleted, and forms and API requests are re-sent with test data. To continue, type the exact host name. Two options are off by default: letting the scanner click visible controls, and file upload testing (uploaded test files may remain on the system). Only use Deep Active if you are allowed to test the system and have a backup.

### Schedule

Choose **One-shot scan** to start now, or **Recurring scan**. Only an Expanded scan of a single host can repeat – **Daily**, **Weekly** or **Monthly**, as often as your plan allows. You can run the first scan as soon as possible or pick a **First run** time.

Recurring scans use credits from a company-wide budget: the **Scheduled security scan credit limit** under **Settings → Billing → Billing settings**. It is 0 by default, which means no scheduled paid scans run. If a scheduled run is not covered by the limit or by your credits, it is skipped and the schedule continues with the next date.

## Step 4 – Review & start

![Scan wizard step 4: review targets, credits and what the scan covers](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/scan-step-review_sxor5j.jpg)


The summary shows the targets, depth and runs, the credits (available, this scan, remaining), **What will happen** and **What it will not cover**. Click **Start … scan** (or **Schedule … scans**).

If there are not enough credits, the scan cannot be started – unless your contract includes paid overage. You can buy more credits from the link on this step (see "How Credits Work – Costs, Balance and Buying More").

## While the scan runs

- The scan page refreshes itself and shows each stage, for example port scan, site crawl and vulnerability checks.
- Scans run one after another. If another scan is running, yours waits as **Pending**.
- A host can have one active scan at a time, and a paid scan can start at most once every 10 minutes per host.
- Admins can stop a scan with **Cancel scan**. If you cancel before the scan has started working, the credits are released. A scan you cancel after it has started is still charged. Credits are refunded automatically if a scan fails because of a problem on AutoPhish's side.

## Results

The **Scans** page lists all scans with domain, target, scan type, status, findings and start time. Open a completed scan to see its findings. You work on them in **Issues** – see "Security Center Overview: Issues, Scans, Domains and Exposure". If a scan shows "Coverage incomplete", parts of the host could not be checked, so "no findings" is not a clean result.

To scan again, start a new scan with **New scan**.

## Good to know

- AutoPhish never performs denial-of-service tests, brute force attacks or credential stuffing.
- Starting scans, cancellations and changes to authentication profiles are recorded in the **Audit Log**.