Why most security scans fail on first run
Understand why scans sometimes return "Scan Unavailable" instead of a real grade, and what you can do to get a clean result on the next attempt.
Scan failures
A failed scan is not a failed site
When VibeLeak cannot complete a scan, it marks the result as "Scan Unavailable" rather than assigning a misleading grade. Understanding why helps you get a real result on the next attempt.
WAF blocks
~40%
The most common cause. Bot protection sees the scanner as automated traffic.
Timeouts
~25%
The site responds too slowly for the scanner to complete its checks.
DNS issues
~20%
Propagation delays, misconfigured records, or temporary resolution failures.
Redirect loops
~15%
Misconfigured redirects that trap the scanner in a loop.
Bot protection
WAFs are doing their job — but they block legitimate scanners too
Cloudflare, AWS WAF, and similar services often block automated requests by default. The scanner looks like a bot because it is one, even if its intent is benign.
- Whitelist the scanner IP range if you control the WAF.
- Temporarily lower bot protection sensitivity for the scan window.
- Use a staging environment without WAF for baseline scans.
Note
Performance
Slow sites time out before the scanner finishes
Each scan module has a timeout. If the site takes too long to respond to any individual check, the scan aborts to avoid hanging indefinitely.
Quick fix
Resolution
DNS problems are usually temporary
New domains, recent DNS changes, or intermittent resolver issues can all prevent the scanner from finding the target. These usually resolve themselves within hours.
- Verify the domain resolves from multiple geographic locations.
- Check for CAA or DNSSEC issues that might block validation.
- Wait 24 hours after major DNS changes before scanning.
Action
How to get a clean scan result
Most scan failures are transient. A few simple checks can turn a failed scan into a completed one with a real grade.
Check the URL
Make sure the domain is correct and publicly reachable without authentication.
Temporarily relax WAF rules
If you control the firewall, allow the scanner through for the duration of the scan.
Retry during off-peak hours
Server load and network congestion are lower, reducing timeout risk.
Run from a staging environment
If production is heavily protected, scan staging first to establish a baseline.
Next action
Run the scanner against your own site
The article lands hardest when it turns into a fix list. Scan, close the gaps, and recheck.
Continue reading
More field notes
Workflow
Can Hermes Agent Audit a Live Website? Testing VibeLeak MCP End to End
Connect Hermes Agent to VibeLeak MCP, audit a live website, inspect the security boundary, and export agent-ready remediation evidence.
Open articleSecurity
GPT-5.6 Sol + Codex Security: Scan Outside, Fix Inside
Turn a VibeLeak public-surface scan into a structured security handoff for Codex Security and GPT-5.6 Sol to validate and patch.
Open articleWorkflow
AI agents are checking your website now. Here is the VibeSignal readiness checklist
Search is becoming conversational, agentic, and more selective about what it can understand. This is the practical checklist for making your public website easier for AI agents to find, read, use, and verify.
Open article