How do I stop a scan from testing a certain HTTP method?

Steps

1. Open the profile. Edit it with the pencil icon in Scan Profiles, or begin a new one.
2. Reach Avoid rules. Scroll down the Scope section to Scope rules, then to the Avoid rules block.
3. Add a row. Click + Add rule.
4. Pick Method. Set the Type list to Method.
5. Enter the method. Type the verb in Value, for example DELETE, and add a short Description.
6. Save. Click Save in the footer.

Good to know

Many teams avoid DELETE or PUT on a live system, since those requests change or remove data. An avoid rule is a steer for the scan and sits beside your other controls, so do not treat it as the only guard around data you cannot lose.

Write the rule for each method you care about, because one row covers one value. For stronger limits in production, also write plain rules in the Rules of engagement box, as covered in how to add rules of engagement. You can also switch off the exploitation phase if you want no live tests at all.

To remove the rule later, use the trash icon on its row. Remember that a method rule only matters if your app accepts that method, so check which verbs your API really serves before you add one. Questions about a safe set-up? Write to /contact.

Related questions

• How do I add a focus rule so a scan concentrates on certain paths?
• Which rule types can I use in focus and avoid rules?
• What's the difference between focus rules and avoid rules?
• How do I exclude a URL path or subdomain from a scan?
• How do I delete a focus or avoid rule?

Full tutorial

How to set focus and avoid rules on a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre