Docs
⌘K
← Home Sign In Get Started
Docs › Help › Troubleshooting

Troubleshooting

Solutions to common problems with scanning, authentication, and reports.

Scanning problems

The scan gets stuck at 0% and never starts

This usually means the scanner could not reach your URL at all. Check:

  • The URL starts with https:// or http://
  • The target is reachable from the internet (test with a public tool like downforeveryoneorjustme.com)
  • Your server does not block Shieldome's scanner IP — all scans originate from a single fixed IP address: 63.186.31.77. If your firewall or WAF uses an allowlist, add this IP and your scan will be able to reach the target.
  • The scan queue is not full — at peak times there may be a brief delay before your scan starts. The status bar will say "Queued" if you are in the queue.

The scan completes in under 5 seconds with no findings

If your scan finishes abnormally fast with zero findings, the scanner likely hit a redirect loop, a captive portal, or a page that returns HTTP 200 for all URLs (common in single-page apps). Check:

  • Navigate to the URL in a browser — do you see a login wall or maintenance page?
  • If the site is a SPA, make sure to add the base URL (e.g. https://app.example.com), not a deep link that requires authentication
  • If you need to scan pages behind login, use the IP Override field to point at a staging environment that does not require auth

My firewall blocks the scan — how do I whitelist the scanner?

All Shieldome scans originate from a single, fixed IP address:

63.186.31.77

Add this IP to your firewall, WAF, or security group allowlist to allow the scanner through. This applies to:

  • AWS Security Groups — add an inbound rule for 63.186.31.77/32 on port 443 (and 80 if needed)
  • Cloudflare WAF — create a WAF rule: IP Source Address equals 63.186.31.77 → Allow
  • Nginx / Apache — add allow 63.186.31.77; before your deny all; block
  • GCP Firewall — add an ingress allow rule for source IP 63.186.31.77/32
  • Azure NSG — add an inbound security rule with source IP 63.186.31.77

This IP is static and will not change without advance notice in our changelog.

Scan fails with "Target not authorized"

For security and legal reasons, Shieldome requires you to confirm you have permission to scan the target. On the scan form, check the "I have authorisation to scan this URL" checkbox. If you are using the API, set "scan_authorized": true in your request body.

Scan result shows fewer findings than I expected

Shieldome performs passive detection — it does not attempt active exploitation. Some classes of vulnerability (e.g. authenticated business logic flaws, race conditions, complex stored XSS) require manual testing or a more invasive scanner. Shieldome's checks are designed to detect indicators and misconfigurations without causing harm to your application.

SSL/TLS checks all fail but my cert is valid

This can happen if:

  • Your domain uses a CDN that terminates TLS (e.g. Cloudflare) — Shieldome is checking the CDN's cert, which is valid, but the check may be comparing against your domain's expected properties
  • Your cert uses a non-standard intermediate CA that is not in the default trust stores
  • The cert has just been renewed and the scanner's DNS cache is returning the old IP

Use the IP Override field to point the scan directly at your origin server and bypass the CDN if you need to check the origin cert specifically.

Authentication problems

I can't log in — "Invalid credentials"

  • Double-check your email address — it is case-insensitive but must be the one you registered with
  • Use the Forgot password link on the login page to reset your password
  • Check your spam/junk folder if you are not receiving the password reset email

I'm locked out after enabling 2FA

If you have your backup codes, use one on the 2FA login screen (click Use a backup code instead). If you have no backup codes and no access to your authenticator app, contact [email protected] from the email address registered on your account. The recovery process takes 1–2 business days for identity verification.

"Failed to load 2FA status" error on the profile page

Refresh the page. If the error persists, log out and log back in — your session may have expired. If it still appears, clear your browser's site data for this domain and reload.

API key returns 401 Unauthorized

  • Check that the key is passed in the X-Shieldome-Key header, not as a query parameter or in the body
  • Verify the key is active in Settings → API Keys — it may have been rotated or revoked
  • API keys are account-scoped. If you are on a team account, make sure you are using a key created for the correct account

Report problems

PDF report is missing some findings

The PDF is generated from the findings at the time you click "Download PDF". If you suppressed findings after the scan, they will not appear in subsequent PDF downloads (this is expected behaviour — suppressed findings are excluded from reports). To see suppressed findings, open the result in the app and enable Show suppressed in the filter.

PDF report does not open / is corrupted

Very large scans (100+ findings) can produce PDFs over 5 MB. Some browser-based PDF viewers struggle with these. Download the file and open it in a dedicated PDF reader (Adobe Acrobat, Preview on macOS, or Evince on Linux).

Scheduled scan ran but I received no email

  • Check your spam folder — automated scan-report emails sometimes land there
  • Go to Settings → Notifications and confirm your email is listed and enabled for scheduled scan reports
  • Check the Scan History page to confirm the scheduled scan actually ran (look for the schedule icon next to the scan)

Performance problems

The scan takes very long (over 10 minutes)

A full vulnerability + performance scan typically takes 3–8 minutes. If your scan exceeds 10 minutes, it may have hit a slow endpoint or a server that throttles requests. The scan will eventually time out and report what it found up to that point. Try scanning with type vuln only (not both) to skip the performance checks, which can be slower on large pages.

Getting more help

If you can't find your answer here:

  • Email [email protected] — include your scan ID, the URL you scanned, and a description of what you expected vs. what happened
  • Include your browser and OS if the issue is a UI problem