Scope decides what a scanner may discover and what it may attack. A scope that is too narrow misses vulnerabilities; one that is too wide wastes time, hits third-party systems or breaks things.

How it works

Scope has several parts: which hosts are included (one host, the whole domain, or specific subdomains), which URL paths are included or excluded, and whether discovery and attack follow the same rules. Third-party domains, such as analytics or payment providers, should almost never be attacked.

Why it matters

• Correct scope gives complete coverage of your own application.
• It keeps the scan away from systems you do not own or are not allowed to test.
• It avoids wasted time on irrelevant pages.

Best practices

• Only scan systems you own or have written permission to test.
• Include all your application's subdomains and API hosts.
• Exclude logout, destructive actions and third-party domains.
• Review the discovered URLs after the first scan and adjust.

How Vooki Pro helps

• Separate Discovery scope and Attack scope, so it can map widely but attack only what you allow.
• Host scope options: same host, same domain, or custom hosts, with automatic host analysis.
• Include and exclude URL patterns with a pattern picker, plus scan limits.
• A Scope tab on every scan shows scanned, discovered-but-unscanned and filter-excluded URLs.

Frequently asked questions

Should I include subdomains in a scan?

Include every subdomain that is part of your application and that you are authorised to test.

What should I exclude from a scan?

Logout links, destructive actions, payment providers and any third-party domain you do not own.

Related: How to scan production safely · Scanning applications behind a WAF or rate limits