From 16c7976ff6f2339c9b264c2f3918da6b090e333f Mon Sep 17 00:00:00 2001 From: Patrick Gleason Date: Wed, 9 Sep 2026 12:13:09 -0400 Subject: [PATCH 1/6] docs(cloud): document that a low rate limit costs coverage, not just speed The rate limit control was documented in isolation from the per-host time budget that makes a low value dangerous. The page framed the only cost of throttling as a slower scan, recommended 10-30 req/sec as a starting point, and carried a worked example at 10 req/sec. A customer scanning the full template set at 10 req/sec silently lost every vulnerability finding: the scan hit the per-host budget after the passive templates and reported finished at 100% rather than erroring. - State the coverage consequence and the finished-at-100% symptom - Recommend 100+ req/sec for full template-set scans, and scope low values to small targeted template selections - Raise the 10 req/sec worked example and note why - Caveat applying a rate limit globally - Link the external scanning rate-limit card to the guidance Co-Authored-By: Claude Opus 5 --- cloud/scanning/external-scan.mdx | 4 ++-- cloud/scanning/parameters.mdx | 30 ++++++++++++++++++------------ 2 files changed, 20 insertions(+), 14 deletions(-) diff --git a/cloud/scanning/external-scan.mdx b/cloud/scanning/external-scan.mdx index ac858a98..4b1f1e03 100644 --- a/cloud/scanning/external-scan.mdx +++ b/cloud/scanning/external-scan.mdx @@ -44,8 +44,8 @@ ProjectDiscovery offers multiple scanning approaches, with automated scanning en Add custom headers and variables for specialized scanning requirements. - - Enterprise: Configure custom scan rates to match your infrastructure capacity. + + Enterprise: Configure custom scan rates to match your infrastructure capacity. Set the rate high enough for your template set to finish. diff --git a/cloud/scanning/parameters.mdx b/cloud/scanning/parameters.mdx index ff38dc41..57a4de77 100644 --- a/cloud/scanning/parameters.mdx +++ b/cloud/scanning/parameters.mdx @@ -25,14 +25,20 @@ Enter a descriptive name for your configuration to identify it later. Examples: **Rate limit per host** Set the number of requests per second per host to control scan speed: -- Enter a number (e.g., `60` for 60 requests per second) +- Enter a number (e.g., `100` for 100 requests per second) - Leave empty for maximum speed (default behavior) -- Lower values are more respectful to target hosts -- Higher values increase scan speed but may overwhelm targets +- Lower values are gentler on the target, but reduce how much of the template set the scan completes +- Higher values increase coverage and scan speed, but may overwhelm targets - -Lower rate limit values reduce scan speed but are more respectful to target hosts. Leave empty for maximum speed (default behavior). - + +**A low rate limit reduces coverage, not just speed.** Scans run under a per-host time budget. If the selected templates cannot finish inside that budget at the configured rate, the scan stops at the budget and reports as **finished at 100%** rather than erroring, having run only the templates it reached. Lighter passive checks tend to run first, so a heavily throttled scan across the full template set can return passive findings only and miss vulnerabilities an earlier scan found. + +**Symptom to look for:** a scan that completes normally but returns noticeably fewer findings than a previous scan of the same targets. Check the rate limit on the configuration that was applied. + + + +**Sizing the rate limit:** for scans across the full template set, use **100 requests/second or higher** per host. A low value such as `20` is safe only for a small, targeted template selection that finishes well inside the budget. If a target genuinely cannot take the load, narrow the template selection as well as the rate, so the smaller set still completes. + ### Custom Headers @@ -158,7 +164,7 @@ When you enable the "Enable for all scans" toggle: - **Global Application:** The configuration applies to every scan automatically - **Manual Selection:** You choose when to apply the configuration per scan -**Recommendation:** Use global application for rate limiting configurations to ensure consistent, respectful scanning behavior across all your scans. +**Recommendation:** Global application gives consistent scanning behavior across all your scans. Be deliberate when the configuration carries a *rate limit*: a value chosen for one sensitive host then applies to every scan, including full template-set scans, where too low a value costs coverage. See [Rate Limiting](#rate-limiting). ## Advanced Configuration Examples @@ -184,7 +190,7 @@ When you enable the "Enable for all scans" toggle: - **Custom Headers:** - `X-Forwarded-For: 192.168.1.100` - `User-Agent: Corporate Security Scanner` -- **Rate limit per host:** `10` +- **Rate limit per host:** `100` (high enough for the full template set to finish inside the per-host budget) ## Best Practices @@ -200,10 +206,10 @@ When you enable the "Enable for all scans" toggle: - Limit configuration access to authorized users 3. **Rate Limiting Guidelines** - - Start with lower values (10-30 requests/second) - - Increase gradually based on target capacity - - Use global rate limiting for consistent behavior - - Monitor target server response times + - Start at 100+ requests/second for full template-set scans, and lower it only if the target shows strain + - Reserve low values (10-30 requests/second) for small, targeted template selections + - Narrow the template selection alongside the rate limit when a target needs protecting + - Monitor target server response times, and compare finding counts against a previous unthrottled scan 4. **Template Variables** - Use consistent naming (lowercase, underscores) From e5922d9066db8b1eb63839d5b1b455c1017d5032 Mon Sep 17 00:00:00 2001 From: Patrick Gleason Date: Wed, 9 Sep 2026 12:14:07 -0400 Subject: [PATCH 2/6] docs(cloud): fix two broken links on the external scanning page Both 404 today. `mint broken-links` reports them. - /cloud/scanning/nuclei-scan -> /cloud/scanning/internal-scan (page renamed; the link text already says "learn more about internal scanning") - /cloud/editor/introduction -> /cloud/editor/overview (only introduction_old remains; overview is the live page other docs link to) Co-Authored-By: Claude Opus 5 --- cloud/scanning/external-scan.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cloud/scanning/external-scan.mdx b/cloud/scanning/external-scan.mdx index 4b1f1e03..36e488f1 100644 --- a/cloud/scanning/external-scan.mdx +++ b/cloud/scanning/external-scan.mdx @@ -50,7 +50,7 @@ ProjectDiscovery offers multiple scanning approaches, with automated scanning en - ProjectDiscovery offers Enterprise users gain additional features like custom scan limits, custom rate limits, and fixed scan IPs for whitelisting. Free users are limited to internal vulnerability scans only - learn more about internal scanning [here](/cloud/scanning/nuclei-scan). + ProjectDiscovery offers Enterprise users gain additional features like custom scan limits, custom rate limits, and fixed scan IPs for whitelisting. Free users are limited to internal vulnerability scans only - learn more about internal scanning [here](/cloud/scanning/internal-scan). ## Get Started with External Scanning @@ -117,5 +117,5 @@ Once your scans are complete, you can explore the results to gain insights into ## Next Steps - [Configure Asset Discovery](/cloud/assets/adding-assets) -- [Create Custom Templates](/cloud/editor/introduction) +- [Create Custom Templates](/cloud/editor/overview) - [View Integration Options](/cloud/integrations) \ No newline at end of file From 14b8099985ea57b70ceeca2955101534a00b43bc Mon Sep 17 00:00:00 2001 From: Patrick Gleason Date: Wed, 9 Sep 2026 12:34:37 -0400 Subject: [PATCH 3/6] docs(cloud): name the templates a low rate limit drops Per Davis, who diagnosed the customer case: under a small rate limit only the informational templates fire. Naming that is more useful than "passive checks", because the customer's observable symptom is a completed scan reporting `info` findings only, with the Critical and High findings gone. Also points at the Recommended profile as the lever for a target that genuinely cannot take 100 req/sec, since it already excludes informational templates. Co-Authored-By: Claude Opus 5 --- cloud/scanning/parameters.mdx | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/cloud/scanning/parameters.mdx b/cloud/scanning/parameters.mdx index 57a4de77..91831197 100644 --- a/cloud/scanning/parameters.mdx +++ b/cloud/scanning/parameters.mdx @@ -31,13 +31,18 @@ Set the number of requests per second per host to control scan speed: - Higher values increase coverage and scan speed, but may overwhelm targets -**A low rate limit reduces coverage, not just speed.** Scans run under a per-host time budget. If the selected templates cannot finish inside that budget at the configured rate, the scan stops at the budget and reports as **finished at 100%** rather than erroring, having run only the templates it reached. Lighter passive checks tend to run first, so a heavily throttled scan across the full template set can return passive findings only and miss vulnerabilities an earlier scan found. +**A low rate limit costs vulnerability coverage, not just scan speed.** Scans run under a per-host time budget. If the selected templates cannot finish inside that budget at the configured rate, the scan stops at the budget and reports as **finished at 100%** rather than erroring, having run only the templates it reached. -**Symptom to look for:** a scan that completes normally but returns noticeably fewer findings than a previous scan of the same targets. Check the rate limit on the configuration that was applied. +In practice the cheap informational templates complete and the exploitation templates that confirm real vulnerabilities are the ones dropped. A heavily throttled scan across the full template set can return `info` findings only, missing the Critical and High findings that an earlier unthrottled scan of the same targets reported. + +**Symptom to look for:** a scan that completes normally but returns only informational findings, or far fewer Critical and High findings than a previous scan of the same targets. Check the rate limit on the configuration that was applied. -**Sizing the rate limit:** for scans across the full template set, use **100 requests/second or higher** per host. A low value such as `20` is safe only for a small, targeted template selection that finishes well inside the budget. If a target genuinely cannot take the load, narrow the template selection as well as the rate, so the smaller set still completes. +**Sizing the rate limit:** +- **Full template set**: use **100 requests/second or higher** per host. +- **A target that genuinely cannot take that load**: keep the low rate, but narrow the template selection to match so the smaller set still finishes inside the budget. The [Recommended profile](/cloud/editor/recommended) is a good starting point, since it excludes informational templates and keeps the exploitable ones. +- **Small, targeted selections** (a handful of templates, such as an authenticated login check): a low value such as `20` is fine, because the work fits the budget easily. ### Custom Headers From d6380fd51a1d2de7370784ec9d66a0599572aea9 Mon Sep 17 00:00:00 2001 From: Patrick Gleason Date: Wed, 9 Sep 2026 13:58:47 -0400 Subject: [PATCH 4/6] docs(cloud): fix broken sentence on the external scanning page "ProjectDiscovery offers Enterprise users gain additional features" has two verbs. Same line as the link fix in the previous commit. Co-Authored-By: Claude Opus 5 --- cloud/scanning/external-scan.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cloud/scanning/external-scan.mdx b/cloud/scanning/external-scan.mdx index 36e488f1..41a8e55e 100644 --- a/cloud/scanning/external-scan.mdx +++ b/cloud/scanning/external-scan.mdx @@ -50,7 +50,7 @@ ProjectDiscovery offers multiple scanning approaches, with automated scanning en - ProjectDiscovery offers Enterprise users gain additional features like custom scan limits, custom rate limits, and fixed scan IPs for whitelisting. Free users are limited to internal vulnerability scans only - learn more about internal scanning [here](/cloud/scanning/internal-scan). + Enterprise users gain additional features like custom scan limits, custom rate limits, and fixed scan IPs for whitelisting. Free users are limited to internal vulnerability scans only - learn more about internal scanning [here](/cloud/scanning/internal-scan). ## Get Started with External Scanning From 701aca74b2ceb59b2215800b816140a988b760f8 Mon Sep 17 00:00:00 2001 From: Patrick Gleason Date: Wed, 9 Sep 2026 14:03:53 -0400 Subject: [PATCH 5/6] docs(cloud): tighten the rate limit guidance, drop the reporting detail Davis's review: too transparent, and it read AI. Removed the description of a scan reporting finished at 100% after stopping at the budget. That is a UX flaw being fixed, so it does not belong in customer docs; the guidance stands on its own without it. Cut the Tip and the symptom paragraph into the Warning, dropped the invented label prefixes ("Symptom to look for", "Sizing the rate limit"), the "not just X" construction and the trailing justifications on each bullet. The Rate Limiting section is 763 characters against about 1,900. Co-Authored-By: Claude Opus 5 --- cloud/scanning/parameters.mdx | 29 ++++++++++------------------- 1 file changed, 10 insertions(+), 19 deletions(-) diff --git a/cloud/scanning/parameters.mdx b/cloud/scanning/parameters.mdx index 91831197..eb26747f 100644 --- a/cloud/scanning/parameters.mdx +++ b/cloud/scanning/parameters.mdx @@ -27,24 +27,15 @@ Enter a descriptive name for your configuration to identify it later. Examples: Set the number of requests per second per host to control scan speed: - Enter a number (e.g., `100` for 100 requests per second) - Leave empty for maximum speed (default behavior) -- Lower values are gentler on the target, but reduce how much of the template set the scan completes -- Higher values increase coverage and scan speed, but may overwhelm targets +- Use `100` or higher for scans across the full template set +- Lower values suit small template selections and hosts that need protecting -**A low rate limit costs vulnerability coverage, not just scan speed.** Scans run under a per-host time budget. If the selected templates cannot finish inside that budget at the configured rate, the scan stops at the budget and reports as **finished at 100%** rather than erroring, having run only the templates it reached. +Scans run under a per-host time budget. A rate limit too low for the number of templates selected means not every template runs, and the exploitation templates that find Critical and High issues are the ones dropped. -In practice the cheap informational templates complete and the exploitation templates that confirm real vulnerabilities are the ones dropped. A heavily throttled scan across the full template set can return `info` findings only, missing the Critical and High findings that an earlier unthrottled scan of the same targets reported. - -**Symptom to look for:** a scan that completes normally but returns only informational findings, or far fewer Critical and High findings than a previous scan of the same targets. Check the rate limit on the configuration that was applied. +For a host that cannot take `100` requests/second, narrow the template selection to match. The [Recommended profile](/cloud/editor/recommended) excludes informational templates. - -**Sizing the rate limit:** -- **Full template set**: use **100 requests/second or higher** per host. -- **A target that genuinely cannot take that load**: keep the low rate, but narrow the template selection to match so the smaller set still finishes inside the budget. The [Recommended profile](/cloud/editor/recommended) is a good starting point, since it excludes informational templates and keeps the exploitable ones. -- **Small, targeted selections** (a handful of templates, such as an authenticated login check): a low value such as `20` is fine, because the work fits the budget easily. - - ### Custom Headers Add HTTP headers that will be included in all scan requests. Click "Add another" to add multiple headers. @@ -169,7 +160,7 @@ When you enable the "Enable for all scans" toggle: - **Global Application:** The configuration applies to every scan automatically - **Manual Selection:** You choose when to apply the configuration per scan -**Recommendation:** Global application gives consistent scanning behavior across all your scans. Be deliberate when the configuration carries a *rate limit*: a value chosen for one sensitive host then applies to every scan, including full template-set scans, where too low a value costs coverage. See [Rate Limiting](#rate-limiting). +**Recommendation:** Global application keeps scanning behavior consistent. Note that a rate limit set for one sensitive host then applies to every scan, including full template-set scans. See [Rate Limiting](#rate-limiting). ## Advanced Configuration Examples @@ -195,7 +186,7 @@ When you enable the "Enable for all scans" toggle: - **Custom Headers:** - `X-Forwarded-For: 192.168.1.100` - `User-Agent: Corporate Security Scanner` -- **Rate limit per host:** `100` (high enough for the full template set to finish inside the per-host budget) +- **Rate limit per host:** `100` ## Best Practices @@ -211,10 +202,10 @@ When you enable the "Enable for all scans" toggle: - Limit configuration access to authorized users 3. **Rate Limiting Guidelines** - - Start at 100+ requests/second for full template-set scans, and lower it only if the target shows strain - - Reserve low values (10-30 requests/second) for small, targeted template selections - - Narrow the template selection alongside the rate limit when a target needs protecting - - Monitor target server response times, and compare finding counts against a previous unthrottled scan + - Use 100+ requests/second for full template-set scans + - Reserve 10-30 requests/second for small template selections + - Narrow the template selection alongside the rate limit + - Monitor target server response times 4. **Template Variables** - Use consistent naming (lowercase, underscores) From b7d4a8e712862a4fcb7f6ee9b8db2075568ee57d Mon Sep 17 00:00:00 2001 From: Patrick Gleason Date: Wed, 9 Sep 2026 15:29:57 -0400 Subject: [PATCH 6/6] docs(cloud): soften the certainty on what a low rate limit drops Davis: the templates may find Critical and High issues, and can be dropped. The previous wording asserted both as certainties, which is not true of any given target. Reworked the leading clause to an if/then so his phrasing does not sit next to a second statement of the same idea. Co-Authored-By: Claude Opus 5 --- cloud/scanning/parameters.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cloud/scanning/parameters.mdx b/cloud/scanning/parameters.mdx index eb26747f..8b7afbe8 100644 --- a/cloud/scanning/parameters.mdx +++ b/cloud/scanning/parameters.mdx @@ -31,7 +31,7 @@ Set the number of requests per second per host to control scan speed: - Lower values suit small template selections and hosts that need protecting -Scans run under a per-host time budget. A rate limit too low for the number of templates selected means not every template runs, and the exploitation templates that find Critical and High issues are the ones dropped. +Scans run under a per-host time budget. If the rate limit is too low for the number of templates selected, not every template runs, and the exploitation templates that may find Critical and High issues can be dropped. For a host that cannot take `100` requests/second, narrow the template selection to match. The [Recommended profile](/cloud/editor/recommended) excludes informational templates.