Scan Troubleshooting

Fix scan failures, slow scans, and unexpected results.

#Scan fails immediately

#Connection refused / timeout

Vergate can't reach the target URL. Check:

• Is the URL correct? (try opening it in your browser)
• Is the site behind a firewall that blocks external requests?
• Is the server down?
• Does it require a VPN or local network access?

#SSL/TLS errors

If the target has an invalid SSL certificate, the scanner may fail. The scanner verifies certificates by default. Self-signed certs on staging servers are a common cause.

#Active scan issues

#Active scan never starts

Active scans require:

• A paid plan (Starter, Pro, or Max)
• A running RabbitMQ worker (handled by Vergate infrastructure)
• The active scan engine available

If you're self-hosting, ensure the worker container is running and can access Docker (for the active scan engine).

#Active scan times out

Default timeout is 30 minutes for thorough scans. For large sites, the scan may hit this limit. Try:

• Use fast profile instead of thorough
• Limit the crawler scope
• Use the baseline profile for quick checks

#Scans are slow

#Passive scan takes more than 10 seconds

The crawler might be following too many links. A site with heavy internal linking or infinite scroll can slow down the BFS crawler. This is normal for large sites.

#WAF is throttling

If your site has a WAF (Cloudflare, Akamai, etc.), it may rate-limit the scanner. The scanner auto-throttles on 403/429/503 patterns, but this makes scans slower.

Tip. If you know your WAF's IP allowlist, you can whitelist Vergate's IPs to speed up scans.

#Missing findings

#Crawler didn't reach a page

The crawler follows links breadth-first. Pages that aren't linked from anywhere won't be scanned. Make sure important pages are reachable from the homepage.

#Expected a finding but none appeared

Some checks are heuristic and may not fire for every instance. If you know a vulnerability exists:

• Try an active scan for deeper testing
• Check if the finding is filtered by likelihood (lower likelihood findings may be hidden)
• Some checks require specific crawl paths to trigger

#Profiling issues

#WhatWeb not available

WhatWeb is optional. If not installed, profiling still works with built-in detectors (50+). WhatWeb adds supplementary detection with 1800+ plugins but is not required.

#Wrong technology detected

Detection is based on HTTP headers, meta tags, and HTML patterns. Some technologies are hard to fingerprint. If you see incorrect results, they're usually INFO-level findings with low confidence.