The scanner isn't getting past my login page. What should I check?

Why this happens

The scanner follows the steps you give it, then checks the success condition. If the login page changed, a field name moved, or the success check never matches, the scanner never counts the sign-in as done. A missing code from two-step sign-in has the same effect.

How to fix it

1. Open the profile, choose Authentication and find the Form login block.
2. Check Login URL. It should be the page with the sign-in form, such as https://app.example.com/login.
3. Retype Username and Password. Saved secrets show blank, so a retype rules out a stale value.
4. Check Login type: FORM, SSO, API or BASIC. Pick the one that matches your app.
5. Set the Success condition to something that only appears after sign-in, such as Url Contains /dashboard.
6. Write the Login flow, one step per line, for example Click "Sign in" and Fill #email with username.
7. If your app asks for a code, enter the TOTP secret.
8. Save and run the scan again.

Try the same steps by hand first. If a person cannot sign in with these details, the scanner cannot either.

Do not paste a secret into the Login flow. The steps are plain instructions such as clicking a button or filling a field with the username or password, and the scanner supplies the saved values itself. That keeps credentials out of text that people read.

Still not working?

Open the finished scan and look at the Sitemap tab. Endpoints behind login show a role chip when the sign-in worked. For a changing landing page, see how to set the success condition. Send us the details at /contact.

Related questions

• My app doesn't land on a fixed URL after login. How do I set the success condition?
• My scan found nothing behind the login. Why?
• How do I write the login flow steps?
• How do I let the scanner get past a TOTP two-factor prompt on my app?
• How do I set up form login for the scanner?

Full tutorial

How to set up form login authentication in Cyberlop

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre