How do I exclude a URL path or subdomain from a scan?

Steps

1. Open the profile. Edit a profile with the pencil icon in Scan Profiles, or start a new one.
2. Find Avoid rules. Scroll down the Scope section to Scope rules. The second block is Avoid rules.
3. Add a rule. Click + Add rule under Avoid rules.
4. Pick the type. Set Type to Url Path for a section of the site, or Subdomain for a whole host.
5. Enter the value. Type the path or subdomain, add a short Description, and click Save.

Good to know

Typical things to exclude are an admin area you do not own, a payment page with real transactions, or a third-party host that sits on your domain. Only keep a path out of scope when you have a reason, since it also hides any weakness behind it. Write the reason in the Description so a colleague understands the choice months later.

Avoid rules steer the scan. They are not a safety guarantee on their own, so pair them with clear rules of engagement and, in production, switch off the exploitation phase if you want no live tests. See how to add rules of engagement.

You can delete a rule later with the trash icon on its row, and the next scan will cover that area again. A subdomain rule is handy for a test host or a marketing site that shares your domain but is not part of the app. Need help choosing? Use /contact.

Related questions

• What's the difference between focus rules and avoid rules?
• Which rule types can I use in focus and avoid rules?
• How do I add a focus rule so a scan concentrates on certain paths?
• How do I delete a focus or avoid rule?
• How do I stop a scan from testing a certain HTTP method?

Full tutorial

How to set focus and avoid rules on a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre