Troubleshooting

Scan limit reached

Every manual scan is metered per plan: the allowances for website, vulnerability, network and dark web scans and accessibility audits, and the reset message.

Updated · 2 min read

A scan refused for allowance returns the server's own message with the reset time, and the app shows that message rather than a guess. The results you already have stay readable.

The allowances

Category Free Starter Pro Enterprise
Website scans (domain scan, checkup, homepage SEO) 6 per day 25 per day 50 per day 200 per day
Vulnerability scans 1 per 7 days 5 per day 10 per day 50 per day
Dark web manual checks 1 per day 5 per day 10 per day 50 per day
Accessibility audit starts 3 per hour 3 per hour 3 per hour 3 per hour
Site checks started by hand 6 per hour 6 per hour 6 per hour 6 per hour
Network target scans on demand (add-time scan and Scan now) 3 per day 10 per day 25 per day 100 per day
Free domain adds 250 per 30 days n/a n/a n/a

Windows are rolling: "per day" means the last 24 hours, not midnight.

The messages

  • "The Free plan includes one manual vulnerability scan every 7 days. Your existing results remain available."
  • "Your Free plan includes one manual dark web scan every 24 hours. Existing results remain available."
  • 429 with Retry-After on the API and MCP.

Scanner capacity

Separately from your allowance, the scanner fleet has a daily launch budget across all accounts. When it is exhausted your scan is queued and retried, not refused; the domain page shows "waiting on results" and the scan lands when capacity returns.

Cycling a domain does not reset

Usage counters are account-level and survive domain deletion. Removing a domain and re-adding it does not grant another Free vulnerability scan.

Fixes

  • Wait for the reset the message names.
  • Read what you have: the last results, the history, the inventory. Over MCP the assistant is told to prefer stored results for exactly this reason.
  • Move to the plan whose allowance matches how often you scan.

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.