A one-off scan tells you about the day you ran it. Sites drift: a dependency ships a CVE, a certificate lapses, someone removes a header during a refactor. Set a cadence once and FlawPilot keeps checking, so a regression surfaces the week it lands instead of the next time someone remembers to look.
Run a scan nowIn development. Run a scan today and your history is already building for when scheduling ships.
Week 6: caught a drop a one-off scan would have missed
Daily, weekly, or monthly, chosen per site rather than per account. A marketing page and a payments flow do not need the same attention.
Every run lands against the same property, so the score chart fills in without anyone remembering to rescan. You get a trend instead of a scatter of one-off reports.
Alerts fire on a change, not on a schedule: a score drop, a new critical finding, a check that started failing. A clean run stays quiet.
Pause, resume, change the cadence, or scan on demand at any time. A schedule is a default, not a commitment.
Four steps, and only the first one needs you. After that it runs until you tell it not to.
Choose the site you want watched and how often to check it - daily, weekly, or monthly. Set it per property, so your checkout flow can run daily while a docs site runs monthly.
October 2026
Weekly · MonFlawPilot runs the same checks as a manual scan, on the days you chose, from the outside. Nothing to install, no agent, and no action needed from you on scan day.
Scheduled run
example.com · Mon 12 Oct, 09:00
Same report a manual scan produces. No agent, no install.
A clean run stays quiet. You hear when a score drops, a new critical finding appears, or a check that was passing starts failing - with the run that caused it attached.
Notifications
Security score dropped 88 to 71
New critical finding: Content-Security-Policy header removed
Each run joins the same history, so the score chart shows whether the site is improving or quietly sliding. Compare any two runs to see exactly what changed between them.
Week 6: caught a drop a one-off scan would have missed
Match the cadence to how fast the site changes and how much a quiet failure would cost. A page that has not shipped in six months does not need a daily check; a payment flow does.
| What it is | How often | Why |
|---|---|---|
| Checkout, login, or anything handling money or personal data | Daily | The blast radius of a silent regression is highest here, and these flows usually ship most often. |
| The main marketing site or app front end | Weekly | Frequent enough to catch a bad deploy within days, quiet enough that alerts stay worth reading. |
| Docs, blog, or a landing page that rarely changes | Monthly | Little changes on your side, but certificates still expire and dependencies still get CVEs. |
| Any site, right after a release | On demand | A scheduled run is a safety net, not a replacement for checking a change you just shipped. |
You can change a cadence at any time, and scan on demand whenever you want without touching the schedule.
Both run without you, so they are easy to confuse. They catch different failures, and most teams end up wanting both.
| CI/CD scan | Scheduled scan | |
|---|---|---|
| When it runs | On every commit or pull request | On a calendar, whether or not you shipped |
| What it checks | The code about to be merged | The live site as it stands right now |
| Catches | A regression you are about to introduce | Drift that appears without a deploy |
| Misses | Anything that changes after the merge | A bad change between two scheduled runs |
A CVE disclosed against a dependency you have not touched, a certificate that lapses, a header removed by an infrastructure change - none of these involve a commit, so no pipeline run will ever see them.
See CI/CD scanningUptime monitors tell you the site is up. Pipeline scanners check the code you are about to merge. Neither looks at the deployed site on a day nobody shipped, which is when most of this appears. That gap is what a scheduled FlawPilot run covers.
An uptime monitor sees a 200 and moves on. FlawPilot reads the certificate, the chain, and the protocol config on every run, so an expiry is flagged while it is still a task rather than an outage.
A header can be correct in your config and missing on the deployed site - a proxy, a CDN rule, or an override strips it. FlawPilot checks what the browser actually receives, which is the only version that protects anyone.
Nothing changed in your repository, so no pipeline run fires. A scheduled scan re-checks your dependencies against what is known today, not what was known on merge day.
Most teams stitch this together from three tools and three dashboards. FlawPilot returns all four pillars as one ranked report, so a slow template and a missing header arrive in the same list.
Scheduling is not live yet, but the two things it depends on are. Do these now and the feature has something to work with on day one.
A schedule charts a trend, and a trend needs a first point. Scan your site now and that run becomes the baseline every later run is measured against.
Run a free scanSite Health crawls the whole property and scores each page. It is the check most worth repeating on a schedule, so it is worth seeing what it finds first.
See Site HealthUntil scheduled runs exist, CI/CD scanning catches regressions at the point they are introduced. It covers a different failure, and you will want both.
See CI/CD scanningEarly access
One email when it is live, and nothing else. Join the waitlist and you get it before it is announced anywhere.
Waitlist members get first access and help decide which cadences and alert rules ship first.
Not shipped yet
Scheduled scans are in development. Run a scan today and the trend is already there when scheduling arrives.
Run a free scan
