A one-off scan tells you about the day you ran it. Sites drift: a dependency ships a CVE, a certificate lapses, someone removes a header during a refactor. Set a cadence once and FlawPilot keeps checking your site and your code, and tells you when something changes - so a regression surfaces the week it lands instead of the next time someone remembers to look.
Requires a free account. Website and Site Health schedules need a verified domain; code schedules need a connected repository.
Schedules
Checkout project
Quick scan
Daily · 09:00example.com/checkout
Site Health
Weekly · Mon 02:00example.com
Code scan
Daily · 03:00acme/web-app · main
Emailed 3 recipients: checkout score dropped 17 points
The other two runs were clean, so nobody was emailed about them.
Schedule a quick scan of a URL, a full Site Health crawl, or a code scan of a connected repository. Each runs exactly as it would if you started it yourself.
Daily, weekly, or monthly, at the time and in the timezone you choose. A checkout flow and a docs site do not need the same attention, so each target gets its own schedule.
By default you hear about a run only when something changes: a score drops, new critical or high findings appear, or the run fails. A clean run stays quiet. Switch a schedule to every run, or to no alerts, whenever you like.
Pause, resume, edit, or run a schedule on demand at any time. A schedule is a default, not a commitment.
Every schedule runs one kind of scan against one target, and a project can mix all three.
The four-pillar scan of a single URL: security, performance, infrastructure, and SEO. The URL must sit on a domain you have verified, or on one of its subdomains.
Run a quick scanA full crawl of the site with every page scored. It is the heaviest scan, so it runs at most once a week. The site must be on a verified domain.
See Site HealthRe-scan a connected repository across the dimensions you pick: code security, secrets, dependencies, and code quality. Optionally skip a run when the branch has not changed since the last one.
See code scanningFour steps, and only the first one needs you. After that it runs until you tell it not to.
For a website, add your domain in the dashboard and publish the DNS TXT record it gives you at flawpilot-verify.<your domain>. Leave the record in place - it is checked again on later runs. For code, connect the repository. Then choose the scan, the cadence, the time, and who should hear about it.
October 2026
Weekly · MonEach run starts close to the time you picked - runs are spread out a little so they do not all begin at once. FlawPilot runs the same checks as a manual scan, from the outside. Nothing to install, and no agent.
Scheduled run
example.com · Mon 12 Oct, 09:00
Same report a manual scan produces. No agent, no install.
A clean run stays quiet. On the default setting, the people you chose get an email when a score drops by 5 points or more, critical or high findings go up, or a run fails - with a link to the report that shows why.
Notifications
Security score dropped 88 to 71
New critical finding: Content-Security-Policy header removed
Each run joins the same history, so the score chart shows whether the site is improving or quietly sliding - without anyone having to remember to rescan.
Week 6: caught a drop a one-off scan would have missed
Match the cadence to how fast the site changes and how much a quiet failure would cost. A page that has not shipped in six months does not need a daily check; a payment flow does.
| What it is | How often | Why |
|---|---|---|
| Checkout, login, or anything handling money or personal data | Daily | The blast radius of a silent regression is highest here, and these flows usually ship most often. |
| The main marketing site or app front end | Weekly | Frequent enough to catch a bad deploy within days, quiet enough that alerts stay worth reading. |
| Docs, blog, or a landing page that rarely changes | Monthly | Little changes on your side, but certificates still expire and dependencies still get CVEs. |
| Any site, right after a release | On demand | A scheduled run is a safety net, not a replacement for checking a change you just shipped. |
Quick scans and code scans can run as often as daily; Site Health runs at most weekly. You can change a cadence at any time, and run a scan on demand without touching the schedule.
Both run without you, so they are easy to confuse. They catch different failures, and most teams end up wanting both.
| CI/CD scan | Scheduled scan | |
|---|---|---|
| When it runs | On every commit or pull request | On a calendar, whether or not you shipped |
| What it checks | The code about to be merged | The live site as it stands right now |
| Catches | A regression you are about to introduce | Drift that appears without a deploy |
| Misses | Anything that changes after the merge | A bad change between two scheduled runs |
A CVE disclosed against a dependency you have not touched, a certificate that lapses, a header removed by an infrastructure change - none of these involve a commit, so no pipeline run will ever see them.
See CI/CD scanningUptime monitors tell you the site is up. Pipeline scanners check the code you are about to merge. Neither looks at the deployed site on a day nobody shipped, which is when most of this appears. That gap is what a scheduled FlawPilot run covers.
An uptime monitor sees a 200 and moves on. FlawPilot reads the certificate, the chain, and the protocol config on every run, so an expiry is flagged while it is still a task rather than an outage.
A header can be correct in your config and missing on the deployed site - a proxy, a CDN rule, or an override strips it. FlawPilot checks what the browser actually receives, which is the only version that protects anyone.
Nothing changed in your repository, so no pipeline run fires. A scheduled scan re-checks your dependencies against what is known today, not what was known on merge day.
Most teams stitch this together from three tools and three dashboards. FlawPilot returns all four pillars as one ranked report, so a slow template and a missing header arrive in the same list.
Set it once
Pick a target and a cadence, and FlawPilot keeps watching - and stays quiet until something changes.
