Cookie settings

Scan pages that need a sign-in

Give SiteScan a test account once, or paste a sign-in, so it can open pages people see only after they sign in.

Plans. Starter, Plus, Business, and Pro.

A public scan stops at the sign-in screen. That means pages that are secured behind a login aren't automatically scanned for accessibility errors. They may be part of your payments process or shopping cart, or other pages that require site visitors to login to see them.

Give SiteScan a test account. SiteScan signs in, reuses that sign-in for the scan, and signs in again when it expires during that scan.

During setup, the step Pages behind a login asks for this before the first scan. Add the pages and a test username and password there. SiteScan deletes that login when the scan finishes, unless you tick Keep this test login for later scans. If you skip it, you can still add the login later.

Give SiteScan a test account

Use a test account that can see the pages you want checked. Do not use a customer account that can pay or place a real order.

Only the team account manager can save or clear the test account. Anyone on the account can run the scan.

  1. On Pages, choose Add pages and type the path. A signed-in page is usually missing from the public sitemap. Use one line for each page, such as account/orders. Press Add to page list.
  2. Open Settings → Scan filters and find Test account.
  3. Enter the username and password once. The password is not shown again. Leave the password blank later if you are only changing the other fields.
  4. If an expired sign-in already opens the sign-in page, leave Sign-in page blank. Otherwise paste the path, such as /login.
  5. Leave Allow SiteScan to press Log out and Allow SiteScan to place an order unticked unless you want those steps.
  6. Press Save test account.

SiteScan signs in on the next scan, keeps that sign-in, and signs in again when it expires. It will not press Log out, and it will not place an order, unless you ticked that step.

Done: you scan a signed-in page without pasting a fresh cookie. The page has a score. If SiteScan cannot sign in, the row says Not scanned and has no score.

A cookie is a short note the website leaves in the browser so the next visit is still signed in. The note has a name and a value, written as name=value. Use this when you cannot give SiteScan a test account. When that cookie expires, you paste a fresh one. A test account does that sign-in for you.

The name is chosen by your website. It is often session, sessionid, or a name from the system that handles your login. Copy the cookie for your website.

SiteScan keeps the cookie you save until the account manager pastes a new one or presses Clear. Closing SiteScan does not remove it. Finishing a scan does not remove it. The next scan of every page on the list sends the same sign-in.

Your website decides when that sign-in ends. Many sites end it when the browser closes, or after a quiet period. When it has ended, the next scan of a signed-in page says Not scanned and has no score. That page is left out of the company score. If a test account is saved, SiteScan signs in again and then scans the page. If you only saved a cookie, paste a fresh cookie from a browser that is signed in, save it, and scan the page again.

Do this in Chrome, on the website you want scanned. Sign in there first.

  1. Open a page that requires a login, such as the account or orders page.
  2. Right-click the page and choose Inspect.
  3. Open the Application tab.
  4. In the left column, open Cookies and click your website's address. Use that site, not SiteScan.
  5. Find the cookie that is present while you are signed in and missing when you are signed out. Click it. Copy the Name and the Value.

If several cookies appear only when you are signed in, the page may need more than one. Copy each pair.

You can also open the Network tab, click the request for that signed-in page, and copy the Cookie line under Request Headers. That line is ready to paste.

Only the team account manager can save or clear the sign-in. Anyone on the account can run the scan.

  1. Add the page on Pages, as above.
  2. Open Settings → Scan filters and find Saved sign-in.
  3. Paste one cookie as name=value. Paste several as name=value; other=value. Leave out Path, Domain, Expires, Secure, and HttpOnly.
  4. Press Save sign-in. The box clears and the page says a sign-in is saved. SiteScan does not show the cookie again.
  5. Scan the page from Pages.

Done: the page has a score, such as Fair or Good. The company score includes it.

When the pasted sign-in has expired, the row says Not scanned and the page has no score. It is not counted as a pass. Save a test account so SiteScan can sign in again, or paste a new cookie from a signed-in browser and scan that page again.

To check the sign-in screen itself, add that page and scan it. SiteScan scores the sign-in page. It does not sign in on a page you asked to check as the sign-in screen. Not scanned is for a page you asked to check that opened the sign-in screen instead.