Help & documentation

Move from a public check to a scoped workspace, retained scans, and reviewable evidence.

1. Use the public scan for a bounded, unauthenticated sample, or sign in to work with saved websites and scan history.
2. Select the intended workspace and website before starting or reviewing work; access remains scoped to the active account and role.
3. Treat queued, running, partial, failed, and completed states as different outcomes. A partial result is not a completed scan.
4. Open the retained findings and evidence before assigning remediation or sharing a report link.

Read privacy, consent, accessibility, and report output without overstating what the evidence establishes.

1. Confirm the scan state, included modules, requested page coverage, and evidence-quality warnings before using a score or finding count.
2. Separate automated, inferred, human-review, unsupported, and inconclusive evidence; they do not carry the same confidence.
3. Use framework mappings as evidence organization, not as a legal conclusion or external certification.
4. Treat a public report URL like a shared document and send it only to intended recipients.

Manage membership, project scope, ownership, scan policy, and audit evidence.

1. Grant the least role and project scope needed for each member, then verify the effective access from the member list.
2. Use invitations for new members; do not share accounts, sessions, API keys, or authenticated scan credentials.
3. Review ownership transfers, project deletion, account deletion, billing, and API-key changes as separate high-impact actions.
4. Use the account audit trail to confirm security-sensitive or destructive changes.

Request a reset, understand its success and error states, and recover MFA safely.

1. Choose Forgot password? on the sign-in page and enter your account email. Check your email confirms an admitted request without disclosing account existence. A temporary recovery outage asks you to retry later.
2. Open the single-use link before its exact UTC expiry time. Its 15-minute lifetime includes delivery time. Expired or used links, and requests invalidated by a later credential change, require a fresh request.
3. Choose and confirm your new password. Password changed means the reset succeeded: select Back to sign in, use the new password and complete MFA. Existing sessions and remembered devices were signed out.
4. An invited member without a password must finish the invitation instead. Claiming it verifies the mailbox. A member who already has a password can recover it even if email confirmation was not previously completed.
5. Lost MFA requires an unused backup code or support-assisted identity recovery. A password reset never clears an unfamiliar authenticator automatically.

Review retained team access and restore only trusted integrations after recovery.

1. Resetting a mailbox-bound credential preserves integrations. Recovery of a disowned or unverified credential can suspend attributable keys, revoke pending invitations, cancel ownership transfers and pause integrations in affected accounts. The recovered member and each current owner receive separate notices; accepted teammates stay active.
2. Follow the workspace notice to Sign-in & sessions. Review members, join dates and inviters; remove unrecognised access and revoke unrecognised active keys. Keys created by other members remain for explicit review.
3. Webhook activation is unavailable without an eligible plan and active website. Use Load more to reach older keys or endpoints. Review the destination and use Rotate signing secret before restoring access flagged by a repudiated or unknown-source review. Restoring that endpoint or suspended keys requires the current owner’s explicit risk acknowledgement for those reviews. After rotation, its time remains visible and the acknowledgement concerns the destination instead of the replaced secret. Ordinary recovery reviews do not require that extra acknowledgement. Review custom AI destinations separately and resend necessary invitations.
4. Record the review when finished. Acknowledging it does not restore anything, and teammates are not blocked while it is pending. Use Load more for remaining keys and endpoints, and Team access for additional members.

Configure ongoing checks, interpret health, and control installation notifications.

1. Owners and admins can open Consent → Installation, verify the installation, and enable daily checks. Publishing and rollback request checks automatically; email preferences alone do not enable daily monitoring.
2. A confirmed problem after a healthy baseline can send an alert. A timeout, missing visitor traffic or unavailable verification does not establish that the banner is broken. Read the specific explanation and confirmation state.
3. Verified owners/admins receive email subject to workspace and personal preferences. Recovery mail requires a recorded delivery of that recipient’s incident alert. Delayed obsolete alerts are suppressed.
4. Mute website alerts suppresses customer notifications and emails while checks and subscribed webhooks continue; delivery is unavailable on unsupported plans. Unsubscribe disables the three CMP health email categories together; it does not stop checks.
5. Open incidents are checked daily even with routine daily checks off. Reminders are at most weekly, including when the failure changes. Fix the installation and retest to record recovery; setup completion remains preserved.

Resolve admission limits and find retained files without losing historical evidence.

1. Owners can review effective seats, concurrent-scan slots and history in Billing & usage. The owner, accepted members and unexpired invitations occupy seats; a downgrade does not remove accepted teammates.
2. Queued and running full scans share account slots. At capacity, wait for active work or cancel deliberately. Admitted work keeps its slot through retries and restarts; bounded first-visit setup inventories are exempt.
3. Scheduled scans explain capacity or page-budget postponements and retry on a later scheduler run. Changing the website schedule clears an old postponement label.
4. Select a website and open Retained downloads in Scans or Reports, then Load retained downloads and Load older scans. Existing PDFs and evidence ZIPs remain available outside the interactive history window, subject to your report permissions.
5. No retained PDF means that row has no PDF to download. An archived scan is not a nonexistent scan, and a history restriction does not delete evidence. Extending the allowance restores eligible interactive history.

Protect sign-in, sessions, credentials, and security-reporting workflows.

1. Use a unique password, enroll multi-factor authentication, and review active sessions from security settings.
2. Forgotten passwords can be reset from the sign-in page using a single-use email link. Resetting signs out existing sessions and remembered devices while preserving MFA.
3. Revoke sessions and rotate affected credentials after suspected account or device compromise.
4. Keep API keys, invitation links, login scripts, cookies, tokens, and report links out of tickets and chat.
5. Use the vulnerability-disclosure channel for suspected product or tenant-isolation security issues.

Understand the difference between exports, evidence archives, website purge, and account deletion.

1. The current owner can request an account export from Data & lifecycle, follow its processing status and download it when ready. Exports are available for seven days and include a manifest describing their scope and exclusions.
2. A scan evidence archive packages retained evidence for download; it is not deletion. Permanent website deletion is a separate action with its own retained-data boundary.
3. Account deletion is a reviewed request: it blocks new project and scan processing and stops active scans while retention and legal-hold policy is applied.
4. Do not represent a request as completed erasure. Wait for the completion or exception communication and retain its audit reference.

Review billing state safely and give support the bounded context needed to investigate.

1. Only an authorized workspace owner should open provider billing, change plan or billing interval, or request account export and deletion.
2. Review the effective plan, subscription state, usage, reserved usage, overage description, and any freeze notice before changing billing.
3. For support, provide the workspace name, ticket or scan technical ID, timestamp, visible status, and action attempted.
4. Never send passwords, MFA codes, cookies, API keys, login scripts, full target URLs, or raw provider output to support.

Recognize degraded work, preserve safe diagnostics, and verify recovery.

1. Check the visible scan state and notifications before retrying work. Workspace owners can also review Runtime health in Data & lifecycle.
2. Avoid repeated submissions while an action is pending. Preserve the technical ID, timestamp, stable status, and affected workflow.
3. Use the support channel named in your service agreement or onboarding material and provide only bounded diagnostic context.
4. After recovery, verify the final scan or report state instead of assuming queued or partial work completed successfully.