I can't put several URLs in the Main URL field. Where do the others go?

Why this happens

The form splits the addresses on purpose. The Main URL is the primary URL scans run against, and it takes just one. The second box is for backends and other hosts, such as an API or an admin site. Its help text says "One per line (or comma-separated). Optional."

How to fix it

1. On Targets, click + New target.
2. Type the primary address, such as https://app.example.com.
3. In Backend / additional URLs, add https://api.example.com and the rest, one per line.
4. Pick the scan type, environment and team, then click Create target.
5. You cannot edit a target. Delete it and create it again with the full list.

Splitting the hosts this way keeps the primary address clear. Cyberlop knows which URL is the front door of the app and which are supporting services. You can paste several addresses at once, as long as each sits on its own line or follows a comma.

Still not working?

List only hosts you own or have written permission to test. The profile form reminds you that a profile scans its target’s URLs, so what you enter here defines where scans can go. Read how to add backend URLs and what to do if an API host was not tested. If something is unclear, use the contact page.

Related questions

• How do I add backend or API URLs to a target?
• How do I add a new target?
• My scan didn't test our separate API host. Why?
• What does it mean that targets are immutable?
• How do I change a target's URL or repository after creating it?

Full tutorial

How to add a target in Cyberlop: the New target dialog, field by field

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre