availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Advanced settings

This document describes all available advanced settings for individual targets. Each setting has a plain-language explanation of what it does and, where useful, the value it ships with by default.

Settings marked x-hidden or x-private in the schema aren't included here. The backend or internal scan tuning manages these automatically, and they aren't intended for manual configuration.

Misconfiguration risk

Advanced settings change scanner behavior directly. Incorrect values can cause scans to fail, miss vulnerabilities, or report inaccurate results, and the effect isn't always visible in the scan output.

These settings are intended for cases where Invicti Support has advised a specific value for a specific problem. Don't change them for exploratory or trial-and-error tuning. If you aren't certain what a setting does and why it needs to change, leave it at its default and contact Invicti Support first.

Prerequisites

The Advanced settings tab only appears on a target when you enable the Allow users to configure advanced scan configuration option in Settings > Scanning. For more information, refer to Scanning settings.

Steps to access advanced settings

1. Select Inventory > Targets from the left-side menu.
2. Find the target you want to configure and either:
   • Select anywhere on its row to open the target drawer, then select Edit.
   • Select the three-dot menu (⋮) at the far right of the row and choose Edit target.
3. Select the Advanced settings tab.

HTTP

Settings that control how the engine communicates over HTTP and HTTPS.

SSL

Setting	Description	Default
Enable SSL ALPN	Turns SSL ALPN (Application-Layer Protocol Negotiation) on or off.	true
SSL ciphers (TLS v1.2 and below)	A colon-separated list of the SSL ciphers to use for TLS v1.2 and earlier.	extensive built-in cipher list (see the settings defaults file)
SSL cipher suites (TLS v1.3)	A colon-separated list of the SSL cipher suites to use for TLS v1.3. Leaving this empty disables TLS v1.3.	TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256

PKCS11 SmartCard settings

Configuration for authenticating using a PKCS11 smart card.

Setting	Description	Default
Module path	The path to the PKCS11 module.	empty
PIN	The PIN for the smart card.	empty
Key URI	An optional PKCS11 URI identifying the key.	empty
Certificate URI	An optional PKCS11 URI identifying the certificate.	empty

General

Setting	Description	Default
Request timeout	How long, in seconds, the engine waits for a request to complete.	30
Enable cache	Turns on persistent HTTP storage, used mainly by DeepScan, to reduce memory usage.	true
Prefer IPv6 for DNS lookups	Whether the engine should prefer IPv6 over IPv4 addresses when resolving DNS.	false
Prefer HTTP/2	Whether the engine should prefer HTTP/2 connections when they're available.	false

HTTP logging

Controls what the scanner writes to the logs when HTTP logging is enabled (which happens automatically when a target has debug mode on). Turning on response body logging, or setting a large max body size, can make scan logs grow very large and cause the scan to run out of disk space, so use these settings with caution.

Setting	Description	Default
Request logging	What to log for requests: one of none, headers, or full.	full
Response logging	What to log for responses: one of none, headers, or full.	headers
Only errors	When enabled, only logs traffic when an error occurs.	false
Max body size	The maximum size of an HTTP body to write to the log.	2048

Login

Settings related to authentication during a scan.

Setting	Description	Default
Login sequence timeout	How long, in minutes, the engine waits for a login sequence to finish playing back.	5

AI

Settings that control the AI-assisted features of the engine.

Setting	Description	Default
AI login agent	The AI agent used for AI-aided login.	nova-act
Force AI aided login	Forces AI-aided login to be used before falling back to the scanner's built-in login heuristics.	false
Enable AI form filler	Uses AI to intelligently fill out forms while scanning.	true
Enable AI crawl prediction	Uses AI to predict additional URLs worth crawling.	true
Enable AI BLR	Uses AI to perform Business Logic Recognition (BLR), giving the engine a better understanding of the application's workflows and logic while scanning.	true

Crawling

Settings that control how the engine discovers and traverses content on the target application.

Setting	Description	Default
Detect technologies depth level	How deep the crawl goes when fingerprinting technologies. 0 means unlimited.	0

File extensions configuration

Controls which files are crawled based on their extension.

Setting	Description	Default
Included extensions	Only paths matching these extensions are included.	["*"] (all extensions)
Excluded extensions	A list of file extensions that are skipped entirely during crawling.	around 150 built-in extensions covering images, audio/video, archives, fonts, and office documents (e.g. .jpg, .mp4, .zip, .exe, .docx, .woff)
Extensions (ignore inputs for extensions)	When a file matches one of these extensions, its inputs are ignored.	.js, .swf, .css, .svg, .svn-base

Routing configuration

Controls how the engine detects and handles application routes (URL patterns that represent the same underlying page with different parameter values).

Heuristic route detection

Setting	Description	Default
Max threshold	The maximum threshold used when deciding whether to create a route at the first path segment.	100
Min threshold	The minimum threshold used when deciding whether to create a route.	30
Same type threshold	The threshold applied to path segments of the same type (year, hex value, UUID, number).	10
Skip for	A list of expressions for which routes are never created.	^/wavsep/
Path separators configuration	The delimiter characters used to split a URL path into segments.	/

IAST-based routes

Setting	Description	Default
Enabled	Turns on route detection based on IAST data.	true
Autogenerate examples	Automatically generates example values for IAST-detected routes.	true

Other crawling settings

Setting	Description	Default
Lock custom cookies	When enabled, custom cookies are locked in place and won't be changed by a Set-Cookie response header.	true
CSRF tokens	A list of name patterns that, when matched against a header, cookie, form input, or meta tag name, identify a CSRF token being transferred. Each entry has a name pattern and a scope of either global (applies everywhere) or path (applies only to that location).	empty list
Ignored variations	A list of variation text patterns to ignore during DeepScan.	can I ask you a question please\?, is it ok if I upload an image\?
Link depth	The maximum link depth to crawl. 0 means unlimited.	10
Directory depth	The maximum directory depth to crawl. 0 means unlimited.	15
Directory limit	The maximum number of directories allowed at any single level. 0 means unlimited.	50
File limit	The maximum number of files allowed at any single level. 0 means unlimited.	150
Maximum number of path schemes	Currently unused.	100
Maximum number of pages to crawl	The maximum number of pages the engine crawls. 0 means unlimited.	25000
Maximum number of sitemap links	The maximum number of links allowed in a single sitemap. 0 means unlimited.	250
Accept cookies from all domains	When enabled, the engine won't validate a cookie's domain before accepting it.	false
Use advanced file signatures	Uses advanced page signatures to identify similar pages and ignore relative links found on them.	true
Remove host prefixes	A list of host prefixes stripped from the start of hostnames before comparing them against scope. For example, if www. is listed, https://www.example.com is normalized to https://example.com for scope purposes.	www., www1.
Allow inv-ignore attribute	Lets users mark an HTML tag with class="*inv-ignore*" so the engine ignores that tag and its children.	true
API introspection settings	A list of path / type pairs describing where API definitions can be found (currently only the graphql type is supported).	around 30 built-in GraphQL endpoint paths, e.g. /graphql, /v1/graphql, /graphiql, /gql, /playground
Tracked session headers	Headers, matched by a name pattern and a scope, that the application uses to identify a user session.	X-SFNT-AUTH-TOKEN, X-AUTH-TOKEN, X-AUTH-SECRET, X-AUTHORIZATION, X-*-AUTHORIZATION, X-*-SESSION-TOKEN, AUTHORIZATION, X-*-Verification-Code, X-*-UserId, X-Apitoken, x-api-session, x-api-key (all scoped to *)
Fixed session headers	Session headers with a pre-defined value, each matched by a name pattern and sent within a given scope.	empty list

Input values settings

Setting	Description	Default
Input values settings	Predefined values to use for specific input fields. Each entry has a url pattern (or * for any page) and a list of inputs, where each input specifies a field name pattern, how that pattern should be matched (exact, regex, or wildcard), and the value to use.	173 built-in field-name mappings (all scoped to *), covering common field-name conventions across several languages: search/filter fields, identifiers, contact details, names, addresses, dates, payment fields, and networking fields, so realistic-looking data gets submitted automatically instead of scan-breaking placeholder text

DeepScan settings

Settings for DeepScan, which uses a headless Chromium browser to analyze modern, JavaScript-driven web app targets.

Setting	Description	Default
Use DeepScan	Uses the Chromium browser to better analyze modern web app targets.	true
Enable heuristics	Turns on DeepScan's heuristics.	true
Fetch external URLs	Fetches URLs requested by the browser even when they fall outside the scan's scope.	true
Allow out of scope submits	Allows or blocks submitting multipart/form-data or application/x-www-form-urlencoded forms to out-of-scope targets.	false
Block ads	Blocks domains known to serve ads while DeepScan is running.	false
Session timeout	The maximum time, in seconds, to wait for a browser session to finish.	240
Send session headers	Sends session-related headers, such as Authorization, while DeepScan is running.	false
Max sessions	The maximum number of browser sessions to run during the scan, up to 5.	5
Dynamic session timeout	When enabled, the engine waits for 30 seconds of idle time before ending a session, but a session can never run longer than twice the configured session timeout.	false
Detect LLM	Detects and blocks requests to known Large Language Model endpoints, to prevent data leakage.	true
Enable DeepScan hash	When enabled, some pages may be skipped as an optimization based on a computed DeepScan hash.	true
Detect client side technologies	Detects client-side technologies used by the target application, for later analysis with runtime software composition analysis (SCA).	true
Ignored URLs	A list of regex patterns for URLs that DeepScan should ignore.	patterns matching YouTube embeds and Vimeo player URLs
Interaction delay	The delay, in milliseconds, between each simulated interaction.	0
Pre-simulation wait	The delay, in milliseconds, before simulation starts.	0
Exclude by CSS selector	A CSS selector identifying elements to exclude, for example .class1, #id2, div > .class3. See Exclude elements using CSS selectors or XPath expressions.	empty
Exclude by XPath expression	A list of XPath expressions identifying elements to exclude. See Exclude elements using CSS selectors or XPath expressions.	empty list
Skip custom events	Skips simulation of non-standard, custom events.	false
Exclude by JavaScript event name	A list of event names that shouldn't be simulated.	empty list
Always trigger standard events	Forces standard events registered on an element to fire, even if they normally wouldn't.	false
Pre-emptive setTimeout	Automatically triggers setTimeout callbacks.	true
Max simulated elements	The maximum number of elements to interact with. 0 means unlimited.	0
Maximum option elements	The maximum number of options to simulate within a <select> dropdown. 0 means unlimited.	0
Max modified element depth	The maximum depth of simulated elements. 0 means unlimited.	0
Skip threshold (sampling)	The number of interactions to perform before starting to skip elements in the queue. 0 disables sampling.	0
Elements to skip (sampling)	Once the skip threshold is reached, the number of elements to skip simulating before resuming.	10
Skip #document node	Skips interaction with events on the #document node.	false
Skip standard events on #document node	Doesn't simulate standard events on the #document node.	false

IAST settings

Settings for Interactive Application Security Testing (IAST) queries sent to an installed IAST agent.

Setting	Description	Default
Send filelist query	Enables or disables sending the filelist IAST query.	true
Send alerts query	Enables or disables sending the alerts IAST query.	true
Send packages query	Enables or disables sending the packages IAST query.	true
Send routes query	Enables or disables sending the routes IAST query.	true
Send system info query	Enables or disables sending the sysinfo IAST query.	true

Scanning

Settings that control the vulnerability scanning phase itself.

Malware scanner

For internal agents only.

Setting	Description	Default
Enabled	Turns malware scanning on or off.	true
Disable Windows Defender integration	On Windows, Windows Defender is used by default; enable this to use ClamAV instead.	false
ClamAV port	The TCP port ClamAV listens on.	3310

Path heuristics configuration

Setting	Description	Default
Enabled	Turns path-based heuristics on or off.	true
Patterns	A list of rules, each with an applyTo (path or dynamic-segment), a handling (excluded or fixed), a valuesCount, and a pattern.	around 30 built-in rules: excludes noisy paths like minified assets (*.min.css/*.min.js), index.html, and ASP.NET web resource handlers; treats common static/CMS paths (e.g. /wp-content/plugins/, /static/, /images/) as fixed; and treats UUID-like or multi-digit dynamic segments as fixed/minimal-value segments

Alert and error limits

Setting	Description	Default
Alert limit per type	Vulnerabilities that aren't merged or dropped can accumulate; this caps how many times the same vulnerability type is reported to the backend for the same target. 0 disables the limit.	250
Abort scan on network errors count	Aborts the scan after this many consecutive network errors. 0 disables the limit.	25

Rate limiting

Controls how the scanner reacts to server-side rate limiting (HTTP 429). Configure request pacing (jobs per minute, concurrent request limits) separately under HTTP settings.

Setting	Description	Default
Ignore persistent 429 responses	When enabled, the scanner tries to handle 429 responses but won't abort the scan if they keep occurring. This can lead to inconsistent scan results.	false

Other scanning settings

Setting	Description	Default
Use cookies detected during scanning	When disabled, the scan-script operation won't set or change cookies while scanning.	false
Proof of exploit	When enabled, the engine generates proof of exploitation for vulnerabilities it finds.	true
Test client-side routes	Controls whether scan-scripts are bypassed on client-side routes, except for those explicitly tagged cs_route.	false
Enable LLM scanning	Turns on scanning for vulnerabilities related to Large Language Models.	true
Stateful API scanning	Enables or disables stateful API scanning.	true

HTTP headers

Configuration for testing HTTP headers for vulnerabilities.

Setting	Description	Default
Enabled	Turns on testing of the headers listed below.	true
Max depth	The maximum location depth at which headers are tested.	2
Headers	The list of headers tested across all locations (post-scan, with cookies), each with a name and whether it's enabled.	Referer, User-Agent, X-Forwarded-For, Accept (all enabled)

Input handling

Setting	Description	Default
Default test value	The value used for any input as a last resort, when no other value can be detected, generated, or matched from a more specific rule.	1
Parameter exclusions	A list of rules, each with a name regex, a kind (Any, GET, POST, or COOKIE), a url pattern, and an exclude action, that keep matching inputs out of testing. See Parameter exclusions.	around 27 built-in rules covering common session identifiers and framework state fields, e.g. ASP.NET_SessionId, PHPSESSID, JSESSIONID, the ASP.NET __VIEWSTATE/__EVENT* fields, authenticity_token, and Subversion .svn-base artifacts
Enable scan auto-tuner	Lets the engine automatically adjust scan settings for known applications. See Enable scan auto-tuner.	true

Input schemes

Settings controlling how input schemes (the combinations of inputs found on a page) are built and classified during crawling and scanning.

Thresholds

Limits related to crawling and scanning depth.

Setting	Description	Default
Ignore if value count greater than	The maximum number of possible test values allowed for a single form input, within a variation.	32
Maximum scheme count	The maximum number of input schemes allowed per location, excluding the empty scheme.	20
Maximum input count	The maximum number of inputs allowed within a single scheme.	100
Maximum variation count	The maximum number of variations allowed per input scheme.	200
Maximum identical groups	The maximum number of identical input groups (matched by input count, names, and flags) allowed across different locations within the same target.	0
Minimum values count	The different-value threshold used for the least important, non-action inputs.	3
Medium values count	The different-value threshold used for medium-importance, maybe-action inputs.	10
Maximum values count	The different-value threshold used for important, action inputs.	32

Action patterns

Patterns used to classify inputs as important ("action") or unimportant ("variable") based on their name or value.

Setting	Description	Default
Include name patterns	Regex patterns for input names that mark them as important action inputs.	around 17 built-in patterns, e.g. action, module, option, mode, op, page, screen, menu, form, stage
Include value patterns	Regex patterns for input values that mark them as important.	matches any value (.*)
Exclude name patterns	Regex patterns for input names that mark them as unimportant/variable.	around 60 built-in patterns covering session/token fields (session, sid, viewstate, jsessionid), common form fields (email, username, password, first_name, address, company, phone), sorting/filtering (sort, orderby, filter, search), and locale/date fields (language, country, date, month, year)
Exclude value patterns	Regex patterns for input values that mark them as unimportant.	around 10 built-in patterns covering purely numeric values, known PHP/session placeholder tokens, HTML/bracketed content, full URLs, common hex hash lengths, boolean-like values (on/off/yes/no/true/false), and sort direction values (asc/desc)

Miscellaneous

Setting	Description	Default
Landing page screenshot	When enabled, the engine takes a screenshot of the landing page.	true
Authentication report	When enabled, the engine saves an authentication report during login sequence playback.	true

Mask sensitive information

Configuration for masking sensitive information before it reaches the backend.

Setting	Description	Default
Mask vulnerability details	Masks sensitive information within vulnerability details.	true
Mask scan log	Masks sensitive information within scan logs.	true
Mask all cookies	Masks every cookie, not just the ones explicitly listed below.	false
Headers	The list of header names to mask.	Authorization, Proxy-Authorization, Acunetix-Aspect-Password
Cookies	The list of cookie names to mask.	password, pass, ASP.NET_SessionId, .AspNetCore.Session, ASPSESSIONID, jsessionid, PHPSESSID

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center