Add New Configuration

Use Add New Configuration to define how Scheduled Scanning should run for a website, including scan frequency, rate limiting, and the URLs to be audited.

Open the Configuration Screen

To create a new configuration:

• Navigate to My Sites
• Select a website
• Click Scheduled Scanning
• Click Add New Configuration (top right, above the configurations table)

This opens the Scan Configuration screen.

Scan Configuration

The Scan Configuration screen is where you define scheduling and manage URLs for a scheduled scan.

Settings are grouped into four collapsible sections, and all of them are saved together with a single save action:

• Basics - Display Name, Rate Limiting and Scan Frequency
• Scanning options - WCAG 2.2 AA and WCAG AAA rules, or the organization defaults
• Access & network - Proxy Settings and Authentication
• Cookies - Cookies the scan sets before it loads each page

Basics is open when the screen loads; the other sections are collapsed and show a one-line summary of their current state (for example “Proxy: organization”, “Authentication: form login” or “2 cookies”), so you can tell what is configured without expanding them. If you try to save while a required field is empty or a value is invalid, the section containing that field opens automatically and moves the cursor to the field.

Basic Configuration

On the configuration screen:

• Display Name (required) - A descriptive name for the configuration.
• Scan Frequency Choose how the scan should run:
  • On Demand - Scans are started manually by the user. Once the configuration is created, the scan can be run immediately or triggered multiple times, but no scans run automatically.
  • Daily - All enabled URLs in the configuration are scanned once per day automatically.
  • Weekly - All enabled URLs in the configuration are scanned once per week automatically.
  • Monthly - All enabled URLs in the configuration are scanned once per month automatically.
• Rate Limiting (optional) Controls how aggressively pages are scanned to avoid overloading servers:
  • None (default)
  • 10 scans / second
  • 5 scans / second
  • 1 scan / second
  • 1 scan / 5 seconds
  • 1 scan / 10 seconds
• Scanning Options - Control additional accessibility scanning behavior for the configuration, including enabling WCAG 2.2 rules and AAA rules. By default, configurations inherit the organization-level scanning settings.
• Infrastructure & Firewall Configuration - If your website is protected by a firewall, Cloudflare, or other security filtering, you may need to allowlist QualiBooth’s Scheduled Scanning IP addresses to prevent scans from being blocked. You can open the “View scanning IP addresses” link to see the current IP addresses used by QualiBooth Scheduled Scanning infrastructure. This is typically required only for websites with strict security restrictions.

Proxy Settings (Optional)

Controls whether this scan configuration uses a proxy server for Scheduled Scanning.

• Use organization proxy (default) - Uses the proxy configured under Settings → Proxy Configuration. If not set, the scan will run without a proxy.
• No proxy - Runs the scan without a proxy
• Use custom proxy - Uses a dedicated proxy configured specifically for this configuration

When using a custom proxy, provide:

• Server URL
• Username (optional)
• Password (optional)

Authentication (Optional)

If the pages you want to scan are only visible after signing in, Authentication lets the scan sign in first, so your pages are audited the way a logged-in user sees them instead of showing the login screen.

Three options are available:

• No authentication (default) - The site is scanned anonymously.
• Form login - QualiBooth signs in through your login page before the scan starts. Provide the Login page URL, Username and Password. The sign-in form is detected automatically, and single sign-on providers are supported.
• HTTP Basic - QualiBooth answers the browser's built-in sign-in prompt, common on staging environments. Provide only a Username and Password.

Passwords are stored encrypted and are never displayed back to you - the field shows a fixed mask, so you can change other settings without retyping the password.

For Form login, the address you provide must open directly onto a visible sign-in form. Forms that appear only after a click (a pop-up, modal, tab or expandable section), two-step logins, two-factor authentication (2FA/MFA) and CAPTCHA-protected login pages cannot be completed by a scan. If your form uses non-standard field names or custom components and is not detected automatically, optional selector overrides are available under Advanced.

Note: HTTP Basic cannot be combined with a proxy that requires its own username and password. If both are configured, a message explains the conflict and the configuration cannot be saved until one of them is changed.

For full setup instructions, advanced options and troubleshooting, see Authentication.

Cookies (Optional)

Cookies are set in the browser before every page in the configuration is scanned. Typical uses:

• Dismiss a consent banner - set the cookie your consent tool stores once a visitor accepts, so the banner never covers the page being audited
• Scan as a signed-in user - carry an existing session cookie, as an alternative to Authentication when the site cannot be signed in to through a form

To add a cookie, expand Cookies, click Add cookie and enter its Name and Value. Use the trash icon next to a cookie to remove it. A configuration can set up to 50 cookies.

Each cookie is sent only to the host of the page being scanned, so no domain, path or expiry is needed.

Cookie values are stored securely and are never displayed back to you. For a saved cookie the value field starts empty: leave it empty to keep the stored value, or type a new value to replace it. If you rename a saved cookie, enter its value again - the stored value is kept by name and does not move to the new name. Users without permission to manage the configuration see only the cookie names.

Cookies must be valid for a browser, otherwise the configuration cannot be saved:

• Name - letters, digits and the characters !#$%&'*+-.^_`|~; no spaces. Each name can appear only once.
• Value - printable ASCII characters other than ;. URL-encode anything else (for example spaces or non-Latin characters).
• Length - name and value together must be 4,096 characters or fewer.

Tip: To find the cookie your consent banner uses, accept the banner in your browser and look under the site's cookies in the browser developer tools (for example Application → Cookies in Chrome). Common examples are OptanonAlertBoxClosed (OneTrust) and CookieConsent (Cookiebot).

Click “Create and Continue” to persist these settings.

Add/Import URLs

A maximum of 10,000 URLs can be added/imported per configuration. You can add URLs using multiple methods:

Add URLs Manually

• Click Add URL
• Enter one or more URLs
  • URLs can be separated by comma, semicolon, or new line
• Click Add

All successfully added URLs are enabled for scanning by default.

Fetch Home Page URLs

• Click Fetch home page URLs
• QualiBooth crawls the homepage and discovers internal links one level deep.
• A modal opens displaying all fetched URLs Note: A maximum of 100 URLs can be imported using this method. If more URLs are discovered, only the first 100 are displayed and available for import. In the modal:
• All URLs are selected by default
• You can select or deselect individual URLs
• Click:
  • Add all to URL configuration, or
  • Add selected URLs to configuration

If no URLs are found, a message is displayed.

Import Sitemap

• Upload or reference a sitemap file
• All valid URLs belonging to the same domain are imported
• Invalid or external URLs are skipped Note: A maximum of 10,000 URLs can be imported using this method.

Import CSV

• Upload a CSV file containing one URL per line
• Column headers (if present) are ignored
• Multiple CSV files can be imported (one at a time) Note: A maximum of 10,000 URLs can be imported using this method.

During import:

• A loading indicator is shown
• Other actions are temporarily disabled

After import, a summary message shows:

• Number of URLs imported
• Number of URLs rejected (invalid, wrong domain)
• Number of duplicate URLs ignored

Managing URLs

Each configuration contains at least one URL by default (the site’s base URL). The URL Management list provides full control over scan inclusion:

• Each URL has a checkbox to enable or disable scanning
• Bulk actions are available when multiple URLs are selected:
  • Enable All
  • Disable All
  • Delete All
• Individual URLs can be deleted using the trash icon
• Pagination options: 20, 50, or 100 URLs per page
• Search is available to filter URLs

Only URLs belonging to the same domain (including subdomains) can be added.

All changes take effect immediately - no additional save action is required.

At the top of the Add/Import URLs section, you can see both the total number of URLs added and the number of URLs currently enabled for scanning.

Starting or Activating a Scan

A primary action button is available on the configuration screen once required settings are saved and URLs are added.

The button behavior adapts dynamically:

• Activate Scan - For new scheduled configurations or such that are inactive
• Deactivate Scan - For active scheduled configurations
• Run Scan Now - For On Demand configurations
• Stop Scan - For On Demand configurations with a scan currently running

If there are no URLs are added, the action button is disabled with a tooltip “Add URLs first”. A scan cannot be started without at least one configured URL.

Returning to Configurations

Use Back to Configurations to return to the configurations list.