How do I run a scan without any login?

Steps

1. Create or edit the profile for your target. See how to create a scan profile if you need a first one.
2. Open the Authentication section. With no roles it shows No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning.
3. Add nothing. If roles exist and you do not want them, remove each with its trash icon.
4. Press Save, then start the scan with Scan.

Good to know

An empty Authentication section is a valid setup. The scanner then reaches what any visitor can reach (unauthenticated access): public pages and open API routes.

• You do not need credentials to run the scan.
• The profile list shows Auth roles as a count, so you can see at a glance which profiles have none.
• The role's Privilege level also has an Unauthenticated option, if you want a named role that stands for a visitor.

Whatever sits behind a sign-in stays out of reach, so a run like this tells you little about it. Findings from a login-free scan cover less of the app. When you are ready, add a role with form login.

Quick, simple and cheap to repeat. That is the appeal of a run with no login, though it also means a smaller view of the app.

This setup suits a first look at a public site, a marketing page or an open API. It is quick to set up and needs no test account. It also makes a good baseline, because anything it finds is something any visitor could reach.

You can keep two profiles on one target, one without roles and one with, since a target can have several profiles. Test only what you have permission to test.

A login-free run is also a sensible first step on a new target, since it shows what a stranger sees before you invest time in test accounts and flows.

Related questions

• What does "No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning." mean?
• How do I remove a login role from a profile?
• How do I add a login role to a scan profile?
• What is an authentication role?
• How do I create a scan profile?

Full tutorial

How to scan behind login in Cyberlop with authentication roles

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre