Scheduled Scans

AllyProof can scan your sites automatically on a recurring cadence so you catch regressions without manual triggering. Scheduled scans run the exact same pipeline as manual scans and fire the same notifications.

Cadence by plan

How scheduling works

A single cron job fires daily at 03:00 UTC. Every run walks the organizations that have scheduled scans enabled and queues a scan for any site whose last scan is older than the plan's cadence — 24 hours for daily, 7 days for weekly. Sites that have been scanned recently are skipped, which means weekly plans naturally scan each site once per week even though the cron runs every day.

03:00 UTC is deliberate: it's after off-peak traffic in most US and European timezones and well before business-hours deployments, so scans don't compete with real users or release windows.

Scans are queued in small batches, not all fired at once, so a big org with many sites doesn't slam your targets with simultaneous traffic.

What runs

A scheduled scan is the same pipeline as a manual or API scan:

1. Page discovery (sitemap or crawl).
2. axe-core + HTML_CodeSniffer + APCA in parallel.
3. Dedup and scoring.
4. AI fix suggestions (Starter and up).
5. Layer 4 AI pattern analysis (Agency and up).
6. Webhook and email notifications.

Page limits follow the plan — scheduled scans are clamped to the plan ceiling (25 / 250 / 1 000 / 10 000 pages per scan).

Changing your schedule

The cadence is tied to your plan — upgrading the plan promotes scheduled scans automatically, downgrading reverts them. There's no separate “turn off” switch: if you need to temporarily stop scans, either downgrade the plan or remove the affected site.

Gating conditions

Scheduled scans skip a site when:

• Ownership verification is required at the platform level and the site is not yet verified.
• A scan for the same site is already in pending or running state.
• The site was scanned within the plan's cadence window (24 h for daily, 7 d for weekly).

Monitoring

• The site detail Scans tab shows every scan with its trigger type (manual, scheduled, or api), so you can see at a glance whether automation is firing.
• Scan-complete emails are off or on per user preference — see Notifications. Scheduled scans are a great candidate for a scheduled-only email filter: high signal, low volume.
• If you integrate via webhooks, scan.completed, violation.new, and violation.resolved all fire for scheduled scans the same as for any other trigger — Webhooks.

Troubleshooting