Resolving Scan Check Issues

Before you start

Before every scan, OneTrust runs a set of checks to make sure it can reach and read your website. This page explains each check and gives you simple steps to work through if a check needs your attention.

Important:

Important: Talk to your IT team before beginning. Some steps involve changes to your network, firewall, security tools, website server, domain settings, or robots.txt file. Always discuss these steps with your IT, security, or website team before making any change. These changes can affect your website's security, availability, and how search engines see your site. OneTrust cannot make these changes for you. Steps that need your IT or website team say "IT team."

Note:

These steps may not fix every issue. The steps below cover the most common causes. Every website is set up differently, so they may not resolve your issue in every case. If the issue continues after you've worked through the steps, contact OneTrust Support (see Contacting Support at the end of this page).

Table 1. What The Results Mean
Result Description
Passed No action needed.
Needs attention The scan can run, but results may be incomplete or slower. Review the steps.
Blocked The scan is unable to run until the issue is fixed.
Informational Something we noticed. This will not stop the scan, and usually no action is needed.
Not evaluated We were unable to run this check because an earlier check did not pass. Fix the earlier check first.

Relevant terms

Term Plain Meaning
Domain Your website's name, such as example.com.
DNS The internet's "phone book". It turns your domain into the address computers use to find your site.
HTTPS / SSL / TLS The secure connection between a browser and your website. Shown as a padlock in the address bar.
Certificate A digital ID that proves your website is genuine. It has an expiry date.
Firewall / WAF / CDN Security and delivery services that sit in front of your website and can block visitors they do not recognize. Examples include Cloudflare, Akamai, and Imperva.
Bot protection / CAPTCHA Tools that ask visitors to prove they are human; for example, by ticking a box or selecting images.
robots.txt A small public file on your website that tells automated tools which pages they may visit.
Sitemap A list of the pages on your website, which helps tools find the the right webpages.
Incognito / private window A browser window that does not use your saved logins or cookies, allowing you to see the site the way a new visitor does.

Reachability checks

These checks confirm that we can find and connect to your website.

# Check What It Means Steps To Resolve Scan Impact
1 DNS resolution We were unable to find your website on the internet. This usually means the address is mistyped, or the domain is not set up to be found publicly.

  1. Check the website address in your scan settings for typos, such as extra letters or the wrong ending (.co instead of .com).

  2. Open the address on a device that is not on your company network, such as a phone using mobile data. If it does not open there, the site is not publicly available.

  3. If the site is internal only (for example, an intranet), it can't be scanned from the internet. Discuss alternatives with your IT team.

  4. IT team: Ask your IT team or domain provider to confirm the domain's public DNS records are set up correctly.

  5. If the DNS records were changed recently, wait up to 48 hours for the change to spread across the internet, then retry the scan.

 Blocked
2 HTTP connection We tried the older, non-secure version of your site (http://). It was either unavailable or sent us to the secure version (https://). This is normal for many websites and is often not a problem.

  1. Type http:// followed by your domain into a browser. If it takes you to the https:// version, no action is needed.

  2. If your site is intentionally available only over https:// and that version works, no action is needed.

  3. If neither version opens, follow the steps for HTTPS connection below.

  4. IT team: If you want http:// visitors sent to https://, ask your website team to set up a redirect.

 Needs attention
3 HTTPS connection We couldn't open a secure connection to your website. The site may be down, not publicly available, or a firewall or security service may be blocking our scanner.

  1. Open https:// followed by your domain in a browser, from a device that isn't on your company network.

  2. If it doesn't open for you either, the site may be down or private. Check with your website team.

  3. If it opens for you, a security service is likely blocking the scanner. Contact OneTrust Support to get the scanner's details (IP addresses and user agent).

  4. IT team: Share those details with your IT or security team and ask whether scanner traffic can be allowed for this website.

  5. Once your IT team confirms the change, retry the scan.

 Blocked
4 TLS certificate We couldn't verify your website's security certificate. It may have expired, be issued for a different address, or be installed incorrectly.

  1. Open your website in a browser. Look for a warning such as "Your connection is not private" or a broken padlock.

  2. Click the padlock (or warning icon) in the address bar and view the certificate. Check the expiry date.

  3. Check that the name on the certificate matches the exact address you're scanning (for example, www.example.com versus example.com).

  4. IT team: Ask your website team to renew or reinstall the certificate, including any "intermediate" certificates. A free online SSL checker can help them find the exact problem.

  5. Once the certificate is fixed, retry the scan.

 Blocked
5 Homepage reachability We couldn't load the page you asked us to scan. The address may be wrong, the page may return an error, or it may be taking too long to load.

  1. Copy the scan address from your scan settings and open it in an incognito (private) window.

  2. Note what you see: an error message (such as "404 Not Found" or "500 Internal Server Error"), a blank page, or a page that takes a very long time to load.

  3. If you see "Not Found", update the scan address to a page that exists, such as your homepage.

  4. IT team: If you see a server error or "Access denied", or the page works for you but not for the scanner, ask your IT team to check the website server and any firewall or security rules.

  5. Retry the scan. If the problem was temporary, it may pass on the next attempt.

 Blocked
6 Redirect validation The address you gave us sent us to a different address. This is often expected, but if it sends us to a different website, we may scan something you didn't intend.

  1. Open the scan address in a browser and note the final address shown in the address bar.

  2. Small changes, such as adding www or switching to https://, are usually fine. No action is needed.

  3. If you end up on a different website (for example, a parent company or a regional site), decide whether that's the site you meant to scan.

  4. If it isn't, update the scan address in your settings to the website you want to scan.

  5. IT team: If the redirect is unexpected, ask your website team to review it.

 Needs attention

Accessibility and authentication checks

These checks confirm that the page contains a real webpage we can read.

# Check What It Means Steps To Resolve Scan Impact
7 Page content The page loaded, but it had little or no visible content. It may be blank, a placeholder ("Coming soon"), or an error page.

  1. Open the scan address in an incognito window and wait for the page to finish loading.

  2. Check whether you see your normal website content or a blank, placeholder, or error page.

  3. If you have to click something before content appears (for example, a country selector or age check), note this. The scanner may not get past it, so consider scanning a page beyond that step.

  4. If the page is a placeholder, update the scan address to a page with real content.

  5. Retry the scan.

 Needs attention
8 Content type The address returned a file or data instead of a normal webpage, for example a PDF, a download, or raw data.

  1. Open the scan address in a browser. If a file downloads, or you see raw text or code instead of a webpage, it isn't a webpage.

  2. Update the scan address to a normal webpage, such as your homepage.

  3. IT team: If you believe the address should show a webpage, ask your website team to check how the server is set up to send that page.

 Needs attention
9 Login requirement The page appears to ask visitors to sign in. If so, the scanner can only see what a signed-out visitor sees.

  1. Open the scan address in an incognito window, signed out. Check whether you see a sign-in page.

  2. If you see normal content and no sign-in page, this may be a false alarm (for example, a "Log in" link in the menu). No action may be needed.

  3. If sign-in is expected (for example, a members' area), set up login settings for the scan in OneTrust. Use a dedicated test account, not a personal or admin account.

  4. Use the option to test your login settings before running the scan.

  5. If the site should be public, ask your website team to remove the unexpected sign-in, or use a public page as the scan address.

 Needs attention

Crawlability checks

These checks confirm that your website allows the scanner to visit its pages.

# Check What It Means Steps To Resolve Scan Impact
10 robots.txt availability We couldn't fully read your robots.txt file. This file tells automated tools which pages they may visit.

  1. Open your domain followed by /robots.txt in a browser (for example, https://example.com/robots.txt).

  2. If you see "Not Found" and your website doesn't use a robots.txt file, no action is needed.

  3. IT team: If you see "Access denied", "Forbidden", or a server error, ask your website team to make the file publicly readable.

  4. Once the file opens in a browser, retry the scan.

 Needs attention
11 Scanner access in robots.txt Your website's rules, or a security service, appear to block the scanner from visiting your pages.

  1. Open your domain followed by /robots.txt in a browser. Look for Disallow: / under User-agent: * or under a line that mentions OneTrust. This blocks automated tools.

  2. Contact OneTrust Support to get the scanner's details (user agent and IP addresses).

  3. IT team: Ask your website team whether a rule can be added to robots.txt to allow the OneTrust scanner. Changes to this file can affect search engines too, so make sure the right people review them.

  4. IT team: Ask your IT or security team to check whether a firewall or bot-protection service is blocking the scanner, and whether it can be allowed.

  5. Once the changes are confirmed, retry the scan.

 Blocked
12 Sitemap discovery We didn't find a link to a sitemap in your robots.txt file. A sitemap helps the scanner find your pages. Without one, the scanner finds pages by following links.

  1. If you've already listed the pages you want scanned in your scan settings, no action is needed.

  2. Check whether your site has a sitemap by opening your domain followed by /sitemap.xml.

  3. IT team:If a sitemap exists, ask your website team to add a line to robots.txt that points to it, such as Sitemap: https://example.com/sitemap.xml.

  4. Alternatively, add your most important pages directly to your scan settings.

 Informational

Protection and access-control checks

These checks look for security tools that may stop the scanner from seeing your pages.

# Check What It Means Steps To Resolve Scan Impact
13 reCAPTCHA We found Google reCAPTCHA on your site. It asks visitors to prove they are human and may stop the scanner.

  1. Open your site in an incognito window and note where the challenge appears: on every page, or only on forms such as contact or sign-up.

  2. If it appears only on forms, the scan is often unaffected. No action may be needed.

  3. If it appears before your content loads, contact OneTrust Support to get the scanner's details (IP addresses and user agent).

  4. IT team: Ask your IT or security team whether the scanner can be excluded from the challenge for the pages you scan.

  5. As an alternative, provide a test website address without the challenge. Make sure it uses the same cookies and tags as your live site, otherwise the scan results won't reflect your live site.

 Needs attention
14 hCaptcha We found hCaptcha on your site. It asks visitors to prove they are human and may stop the scanner.

  1. Open your site in an incognito window and note where the challenge appears: on every page, or only on forms such as contact or sign-up.

  2. If it appears only on forms, the scan is often unaffected. No action may be needed.

  3. If it appears before your content loads, contact OneTrust Support to get the scanner's details (IP addresses and user agent).

  4. IT team: Ask your IT or security team whether the scanner can be excluded from the challenge for the pages you scan.

  5. As an alternative, provide a test website address without the challenge. Make sure it uses the same cookies and tags as your live site, otherwise the scan results won't reflect your live site.

 Needs attention
15 Cloudflare challenge Instead of your website, we saw a Cloudflare check page (for example, "Just a moment…" or "Checking your browser"). The scanner may not get past it.

  1. Open your site in an incognito window. Note whether you see a Cloudflare check page before your content.

  2. Contact OneTrust Support to get the scanner's details (IP addresses and user agent).

  3. IT team: Share those details with the team that manages your Cloudflare account. Ask whether the scanner can be allowed for the pages you scan.

  4. IT team: Ask them to confirm the change works for the scanner's traffic, not just from your office network.

  5. Retry the scan.

 Needs attention
16 Generic bot challenge Your site asked us to prove we're human, so some content may not be scannable. This is usually caused by a bot-protection service.

  1. Open your site in an incognito window. Note whether you're asked to prove you're human, and on which pages.

  2. If you don't see any challenge and your content loads normally, this may be a false alarm. Retry the scan.

  3. Contact OneTrust Support to get the scanner's details (IP addresses and user agent).

  4. IT team: Ask your IT or security team which bot-protection service your site uses, and whether the scanner can be allowed or the challenge reduced for the pages you scan.

  5. As an alternative, provide a test website address without the challenge. Make sure it uses the same cookies and tags as your live site.

 Needs attention
17 Rate limiting Your website limits how many requests one visitor can make in a short time. The scan may be slower or miss some pages.

  1. Wait a while and retry the scan. Limits often reset after a few minutes. Retrying outside your busiest hours can also help.

  2. If it keeps happening, contact OneTrust Support to get the scanner's details (IP addresses and user agent).

  3. IT team: Ask your IT or security team whether the scanner can be given a higher request limit for the duration of the scan.

  4. Ask OneTrust Support whether the scan can run more slowly for your website.

 Needs attention
18 Access denied Your website refused to let the scanner in. The result details show either a 401 (sign-in needed) or a 403 (access refused) code.

  1. Check the result details for the code: 401 or 403.

  2. If 401: The page needs a sign-in. Set up and test login settings for the scan in OneTrust, using a dedicated test account.

  3. If 403: Contact OneTrust Support to get the scanner's details (IP addresses, user agent, and the region it scans from).

  4. IT team (403): Ask your IT or security team to review firewall, security, and location-based rules that could block the scanner, and whether it can be allowed.

  5. Retry the scan.

 Needs attention

Health and performance checks

These checks measure how quickly and reliably your website responds. Most are for information only and don't stop the scan.

# Check What It Means Steps To Resolve Scan Impact
19 DNS latency Finding your website's address took longer than usual. This is a performance observation and doesn't stop the scan.

  1. No action is needed for a single occurrence.

  2. IT team: If this appears in several scans, share it with your IT team or domain provider.

 Informational
20 Network latency Your website's server took longer than usual to accept a connection. This doesn't stop the scan.

  1. No action is needed for a single occurrence.

  2. IT team: If this appears in several scans, ask your IT or hosting team to review your network and hosting performance.

 Informational
21 TLS response time Setting up the secure connection to your website took longer than usual. This doesn't stop the scan.

  1. No action is needed for a single occurrence.

  2. IT team: If this appears in several scans, ask your website team to review your certificate and secure-connection setup.

 Informational
22 Initial response time (TTFB) Your website's server took longer than usual to start sending the page. The scan may take longer.

  1. Open your site in an incognito window and check whether it feels slow to start loading.

  2. Retry the scan later. Slow responses are often temporary, for example during busy periods.

  3. IT team: If this appears in several scans, ask your website or hosting team to review server performance.

 Informational
23 Availability Your website wasn't consistently reachable while we checked it. Some attempts to load it failed.

  1. Check whether your website had any planned maintenance or outages around the time of the scan.

  2. Retry the scan later.

  3. IT team: If this keeps happening, ask your website or hosting team to investigate stability issues. Share the date and time of the scan.

 Informational
24 Server error Your website returned a server error (an error code starting with 5, such as 500 or 503), so we couldn't scan it.

  1. Open your site in an incognito window and check whether you see an error page.

  2. If the site works normally now, the error may have been temporary. Retry the scan.

  3. IT team: If you see the error, ask your website team to fix it before retrying.

  4. IT team: If the site works for you but the error keeps appearing in scans, ask your IT team to check the server and security logs for the date and time of the scan.

  5. Retry the scan once the issue is fixed.

 Blocked

Contacting Support

If you've worked through the steps and the issue continues, contact OneTrust Support. Include:

  • The website address you're scanning

  • The name of the check and the result shown

  • The date and time of the scan

  • What you've tried so far, and what you saw (screenshots help)

Warning:

Don't share passwords, cookies, or other sensitive information in your Support request.