> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/troubleshooting/scan-results/troubleshooting-low-coverage-in-a-scan.md). # Troubleshoot low coverage in a scan A scan must cover as much of the target scope as possible to identify the maximum number of vulnerabilities. If your scan shows low coverage, follow these troubleshooting steps to identify and resolve the issue. For more information about coverage reports, visit [Coverage report](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/overview-reports/coverage-report.md) and [Generate CSV coverage report](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/overview-reports/generate-csv-coverage-report.md). ## The problem When running a scan on a target, the coverage is low. ## Troubleshoot the problem Work through the following steps to identify possible causes and solutions. ### Step 1: Check for target authentication If the target has authentication, verify the scanner logged in. 1. Navigate to the **Targets** page. 2. Click the target name to see its details. 3. Click **Scan Activity** to see the list of scans. 4. Click **View** for the scan you want to check. 5. Click **Crawling Report** to download the spreadsheet with scanned URLs. 6. Check if URLs that are only available for authenticated users appear in the report. If no URLs for authenticated users are listed, the scan failed to log in. | Cause | Solution | | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | The scan failed to log in to the target. | Review the target authentication configuration. For common authentication issues, visit the Troubleshooting Authentication section. | ### Step 2: Check for missing SPA API If the target is a Single-Page Application (SPA) with a backing API, check if the API uses a different URL. For example: * SPA URL: `https://example.com` * SPA API URL: `https://api.example.com` If the backing API has a URL different from the SPA, Snyk API & Web needs to know the API URL to scan the SPA properly. | Cause | Solution | | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The target is a SPA with its backing API on a different URL. | Add the API URL as an extra host in target settings. Visit [Configure extra hosts](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/configure-targets/configure-web-targets/configure-extra-hosts.md). | ### Step 3: Check for a blocking WAF Check if a Web Application Firewall (WAF) is blocking scan requests after the scan has started. 1. Navigate to the **Targets** page. 2. Click the target name to see its details. 3. Click **Scan Activity** to see the list of scans. 4. Click **View** for the scan you want to check. 5. Click **Crawling Report** to download the spreadsheet with scanned URLs. 6. Check if URLs started receiving HTTP 403 error status at some point during the scan. 7. Open a browser in incognito mode and test those URLs to see if a WAF is blocking access. If a WAF blocks access to URLs, Snyk API & Web cannot scan them. | Cause | Solution | | ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A WAF is blocking access to URLs during the scan. | Add Snyk API & Web IPs to the WAF's allowlist. Visit [Configure IPs in WAFs](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scan-access-and-connectivity/configure-ips-in-wafs.md). | ### Step 4: Check for blocking WordPress plugin If the target is WordPress, check if a WordPress security plugin (for example, WordFence) is blocking scan requests. 1. Navigate to the **Targets** page. 2. Click the target name to see its details. 3. Click **Scan Activity** to see the list of scans. 4. Click **View** for the scan you want to check. 5. Click **Crawling Report** to download the spreadsheet with scanned URLs. 6. Check if URLs have HTTP 403 error status. 7. Open a browser in incognito mode and test those URLs to see if a WordPress plugin is blocking access. If a WordPress plugin is blocking access to URLs, Snyk API & Web cannot scan them. | Cause | Solution | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A WordPress plugin (for example, WordFence) is blocking access to URLs. | Configure the WordPress plugin to allow requests from Snyk API & Web IPs. Visit [Scanner IP address](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scan-access-and-connectivity/scanner-ip-address.md) for the scanner's outgoing IP address. | After following these steps and applying the solutions, scans achieve the expected coverage for your targets. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/troubleshooting/scan-results/troubleshooting-low-coverage-in-a-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.