Scan policies

A scan policy decides which checks run. Speed settings on the same wizard step decide how hard the scanner pushes. Together they make the difference between a scan that finishes over lunch and one that is still running tomorrow.

Built-in policies

Policy	What it runs	Use it for
Quick	Security headers and version fingerprinting	A first look at an unfamiliar host, or a fast pipeline smoke test
Focused	SQL, command and code injection, XXE, XSS and headers	High-signal results without the slow, rarely relevant checks
Standard	Headers, versions, injection and XSS	Regular testing that covers the OWASP Top 10 essentials
Deep	Core categories, including SSRF, SSTI and IDOR	Pre-release or pre-audit testing, run overnight
Default	Every check in the catalogue	Full coverage. Recommended, and the slowest.

Default is the widest policy, not Deep. If you are unsure, start with Default and narrow down only if scan time becomes a problem. Built-in policies cannot be edited.

Create a custom policy

Open Config → Policies and click New.
Name it, then tick whole categories or open them to select individual checks.
Save. It appears alongside the built-ins in every scan wizard.

Common custom policies:

Production-safe: remove the destructive and denial-of-service categories, and run at Stealth speed.
Stack-specific: drop the WordPress, Joomla and Drupal checks for an app that has never used PHP.
Regression: only the bug classes you have been caught by before, for a fast CI check.

Speed and throttling

Preset	Parallel requests	Delay
Stealth	2	2 seconds
Normal	5	500 ms
Aggressive	10	none

Setting Requests / second, Concurrency or Delay directly overrides the preset. Where settings conflict, the larger delay wins. Two more options are useful:

Skip timing-based checks: faster, with fewer false positives on slow or noisy networks.
Max payloads / type: caps payloads for each check, trading some coverage for speed.

Attack scope

On the Policy step, Attack include / exclude decides which discovered URLs receive payloads. Exclude logout, delete and download endpoints. They still appear in the sitemap, but they are never attacked.

Full reference, including the whole check catalogue: Scan policies (docs)