How do I keep the scanner away from a particular parameter or header?

Steps

1. Open the profile. Edit it with the pencil icon in Scan Profiles, or begin a new one.
2. Reach Avoid rules. Scroll to Scope rules on the Scope section and find Avoid rules.
3. Add a row. Click + Add rule.
4. Choose the type. Set Type to Parameter for a query or body field, or to Header for an HTTP header.
5. Name it. Enter the parameter or header name in Value, then add a Description.
6. Save. Click Save in the footer.

Good to know

Skip a parameter when changing it would cause side effects you do not want, such as a field that triggers an email or a charge. Do the same for a header your gateway relies on to route traffic or to tell requests apart. Copy names exactly as your app spells them, including any dashes.

Be careful with broad avoid rules. A parameter that carries user input is exactly where many weaknesses sit, so skipping it hides them. Only avoid what you must, and write the reason in the Description so your team can judge the rule later. Review the list now and then, since an old rule can quietly hide a new weakness.

If a field needs special handling, you can also describe it in the Rules of engagement box, or give the scanner context with the Application context. To drop the rule, click its trash icon. Need advice? Use /contact.

Related questions

• How do I stop a scan from testing a certain HTTP method?
• How do I exclude a URL path or subdomain from a scan?
• Which rule types can I use in focus and avoid rules?
• What's the difference between focus rules and avoid rules?
• How do I delete a focus or avoid rule?

Full tutorial

How to set focus and avoid rules on a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre