The Complete User Guide

Some settings are hidden until you turn on Show All Settings under Options in the footer of the scanning interface. They are marked (Visible when Show All Settings is on).

---

1. Main controls

The controls at the top of the scanning interface start, manage and configure a scan.

Website URL or local file pathhttps://www.example.com Start Scan Customise Scan

Text description: scanning interface

Example of the scanning interface: a Website URL or local file path field containing https://www.example.com, a Start Scan button and a Customise Scan link.

• Website URL or local file path: The starting point of the audit, and always the first page scanned. It accepts these formats:
  • https://example.com for a standard web scan.
  • file:///C:/Users/Name/Project/index.html for a local file scan.
  • https://user:pass@example.com for sites that use the browser's own sign-in pop-up (basic authentication). The username and password are removed from logs and reports.
  A Windows path such as C:\Users\Name\Project\index.html, or an absolute path such as /Users/Name/Project/index.html, typed here or into Scan Specific URLs is converted to a file:/// address.
• Start Scan: Locks the configuration and starts the scan. It also asks the system to keep the computer awake while the scan runs. Only one scan runs at a time. If you open the scanning interface in a second window while a scan is running, it shows that scan's progress.
• Before you scan: A message that lists any active settings that change how the scan interacts with the target site, and asks you to make sure you have permission to scan it.
  • It appears when Stealth Mode, Handle Trusted Types, Parallel Processing, Deep Scan, Attempt to Dismiss Overlays or Local LLM Review is on, Respect robots.txt is off or a Proxy Server URL is set. With the default settings, it appears before every scan.
  • Select Continue to scan, or Continue and don't show this again to skip it on future scans.
  • It appears again if you turn on a setting it hasn't warned you about yet, point Local LLM Review at a different server or set a different proxy.
• Confirm Login is Complete: Tells the scanner you have finished signing in and the restricted content is visible. Shown only while a Login URL session is waiting for you. The scan waits up to 20 hours for it, so take as long as you need. If you close the sign-in window instead, the button is hidden and the scan continues signed out.
• Pause / Resume: Halts the scan queue, which frees system resources. The scan stays paused, even with the interface window closed, until you select Resume or Cancel Scan. Not shown when Parallel Processing or Interactive Mode is on. Pause isn't available while the report is being built or the Local LLM Review is running; the button says so, and Cancel Scan still works.
• Finish Early & Scan: Stops discovering new pages and builds the report from the pages already scanned.
  • Pages found but not yet visited aren't scanned. PDFs already found are still checked.
  • It is available only while pages are being discovered, by a crawl, a sitemap or a User Journey, and not with Parallel Processing.
  • After you confirm, the button reads Signal Sent... and then Finishing scan... while the report is built.
• Cancel Scan: Stops all background browser processes straight away and cleans up temporary scan data. Not available while the report is being built.
• Customise Scan: Shows or hides the scan settings described below.
  • They are grouped into Scope (Target & Scope, Crawl Options), Scanning (Scan Behaviour, Viewport & Device, Axe Scan Rules), Reporting (Screenshots & Reporting), Local AI (Optional) (Local LLM Review), Advanced (Advanced Options, Backend Fine-Tuning) and Saved Settings (Save & Load Configurations).
  • While the settings are open, the button reads Hide Customisations, and Reset and Setup appear. The settings close when a scan starts.
• Reset: After you confirm, reloads the scanner with the default settings. Your saved configurations are kept, but your default configuration isn't loaded this time.
• Setup: Reopens the setup walkthrough, described below.

Before you scan Some active settings change how this scan interacts with the target site. Stealth Mode is enabled. The scanner hides automation signals and presents itself as an ordinary copy of Chrome instead of identifying itself as automated traffic. Handle Trusted Types is enabled. The scanner bypasses Trusted Types restrictions on the target page so the rules engine can be injected. Overlay Dismissal is enabled. The scanner automatically clicks Accept, Close or Got it on cookie banners and consent overlays. Ensure you have permission to scan the target. Responsibility for the scan, and for any use of the resulting data, rests with you. CancelContinue and don't show this againContinue

Text description: Before you scan dialog, listing three active settings, with Cancel and Continue buttons

Example of the Before you scan dialog listing Stealth Mode, Handle Trusted Types and Overlay Dismissal, a reminder to ensure you have permission to scan the target, and Cancel, Continue and don't show this again, and Continue buttons.

The setup walkthrough

The setup walkthrough configures the scanner through a series of short questions. It opens by itself the first time you open the scanner, and Setup reopens it at any time. The welcome screen offers Start Setup, which takes about 3 minutes.

Welcome to Octopus Scanner Tune Octopus with a few short questions, or close this window to begin with the defaults. Start Setup About 3 minutes

Text description: setup walkthrough, titled Welcome to Octopus Scanner, with a Start Setup button

Example of the setup walkthrough: a close button, Welcome to Octopus Scanner, Tune Octopus with a few short questions, or close this window to begin with the defaults, a Start Setup button and a label reading About 3 minutes.

• Moving through it: Choose an answer on each screen, then select Next or Back. A progress bar shows how far you are. Each screen opens with its default answer selected, and the suggested answer carries a Recommended badge. More about this setting explains what the selected answer does.
• Closing it: The close button appears only on the welcome screen. On later screens, press Esc to close it. If you close it without finishing, a notice points you to Setup under Customise Scan. Once you close it from the welcome screen or with Esc, it doesn't open by itself again.
• Finishing it: Selecting Finish Setup on the final screen applies your answers and saves them as "User's Default Configuration". That configuration becomes your default and loads every time you open the scanner, replacing any default you chose before.
• Settings it doesn't ask about: These keep their current values, with two exceptions. Finishing the walkthrough always turns on Advanced Link Discovery, and sets Emulation Mode to Standard Viewport.

The questions appear in this order. The two screenshot questions are skipped when you choose a CSV or JSON report.

---

2. Target & Scope

Found under Customise Scan > Scope. These options set the boundaries of the audit. Each one sits behind its own checkbox under Choose What To Set Up, and its settings appear only when you tick it. Unticking an option clears its settings. For User Journey you are asked to confirm first, and it can't be unticked while recording. Some options switch others off. For the full list, see options are greyed out in the Troubleshooting Guide.

• Login Page: Shows Login URL (Optional). The scanner opens a visible browser window at this address first, so you can sign in yourself, including single sign-on and two-factor authentication, before the automated scan starts.
  • Waiting for you: The scan waits up to 20 hours for Confirm Login is Complete, so take as long as you need. If you close the sign-in window or cancel, it continues signed out and says so in the Activity Log.
  • What else it changes: Entering a Login URL turns on Persistent Session, so the sign-in can be reused. Turn Persistent Session off before scanning if you want each scan to start signed out. It also turns Parallel Processing and Periodic Browser Restarts off and makes them unavailable. Clear Login URL to use them again.
  • When not to use it: If the site uses the browser's own sign-in pop-up, leave Login URL empty and put the username and password in the scan address instead. Login URL isn't available for local files or with a User Journey.
• Sitemap: Shows the sitemap options.
  • Sitemap XML URL (Optional): The scanner fetches this sitemap, follows any sitemaps it lists (including gzipped ones), and adds the pages it finds to the scan. The sitemap can be on a different address from the site, such as a separate sitemaps subdomain. Pages on the site being scanned are kept. The site is also crawled unless you turn off Crawl Site Even When Sitemap Provided under Scan Behaviour. Entering a sitemap greys out Scan Specific URLs. Crawl Options still apply, but when Crawl Site Even When Sitemap Provided is off, only the sitemap's pages are scanned, so Max Crawl Depth and Advanced Link Discovery are greyed out.
  • Ignore Sitemaps Discovered In robots.txt: Ignores any Sitemap: addresses listed in the site's robots.txt. Use it when the declared sitemap is out of date and you only want your own sources used.
• Specific URLs & Multi-Domain: Shows the specific page options.
  • Scan Specific URLs / Add Crawl Seeds: A list of pages or files to scan, one per line. By default, the scanner audits only these, so Sitemap, Max Crawl Depth and Advanced Link Discovery are greyed out. The other Crawl Options still apply. Entering a sitemap greys out this list.
  • Also Crawl Links Found On These Pages (Multi-Domain): Treats the listed pages as starting points and crawls outward from them, so Max Crawl Depth and Advanced Link Discovery apply again. If the list includes pages from more than one domain, each domain is crawled.
• Interactive Mode (Manual Step-by-Step): Opens a visible browser with a control panel.
  • You move through the site yourself, select Scan in the control panel to audit the current state, such as an open menu or a filtered view, and select Finish to end the session. The control panel also works on sites with a strict security policy.
  • If you close the browser window instead, the interface reports that the session ended.
  • Not available with Parallel Processing.
• User Journey: Records or builds a sequence of steps that the scanner replays before and during the scan. An active journey replaces the normal URL, sitemap and crawl options, and must include at least one Scan Page step.
  • Record Journey / Finish Recording: Opens a browser and records your clicks, typing, selections and key presses as steps. If the journey already has steps, you are asked to confirm first, because recording replaces them. Select Cancel to keep them. Every other setting is locked while recording. The recording browser closes after 30 minutes, but the steps recorded so far are kept, so select Finish Recording to add them. If a recording is already open, for example after you reload the interface, Record Journey shows Finish Recording so you can collect its steps. Pop-ups such as "Are you sure?" appear in the recording browser for you to answer. Visits to a sign-in return address, such as one carrying a one-time code, aren't recorded as Go to URL steps, because the code can only be used once. Review the steps afterwards and remove any accidental clicks before you scan.
  • Add Step: Adds a step by hand. Choose an Action: Go to URL, Click Element, Type in Element, Select Option, Press Key (Enter/Tab), Scroll Page, Wait for Element, Wait for Time (ms) or Scan Page. Then fill in the fields that action needs: URL, Selector, Text or Time (ms). Press Key needs a key, and Wait for Time accepts 0 milliseconds.
  • Step buttons: Each step has buttons to move it up or down, add a Scan Page step below it, and Remove it. You can also drag a step to a new position.
  • Scan Page: A step that runs an audit at that exact point in the journey. When more than one viewport is scanned, the page stays exactly as the journey left it for each one, and scanning the same address twice keeps both results. Afterwards the window size and browser identity are restored and content the scan revealed is hidden again, so the next steps carry on as recorded.
  • Sensitive Value: Available on Type in Element steps, and turned on automatically for anything typed into a password field while recording. The value is hidden and never saved with a configuration, an exported configuration or a report, so you enter it again before each scan. Other typed values, such as usernames, are shown in plain text and saved with the configuration.
  • Playback: Each step waits only until the page has settled, including a form that is slow to sign you in. A Go to URL step for the page the previous step has already opened is skipped rather than reloading it, a new tab opened by a step is followed, and pop-ups such as "Are you sure?" are accepted. A step whose action has run is never repeated, even if checking its result fails, so a form is never sent twice.
  • Failed steps: If a step fails, a screenshot of the page is saved in the reports folder. The five most recent are kept for up to a week.

---

3. Crawl Options

Found under Customise Scan > Scope. These settings control how the scanner finds and loads pages. They are greyed out while a User Journey, a local file or Interactive Mode is in use, apart from Block Analytics Trackers, which still applies to User Journeys and local files. When only the pages in a sitemap or in Scan Specific URLs are scanned, they still apply, apart from Max Crawl Depth and Advanced Link Discovery, which only apply when the scanner follows links. A greyed-out area shows a short note explaining why.

Crawl Options Max Crawl Depth:Unlimited Crawl Delay:0ms Max Crawl Size:1000pages Exclude URL Patterns:One per line, e.g.
/logout
/admin/ Enable Parallel ProcessingScans multiple pages at once. Faster but uses more resources and may be blocked by some sites. Respect robots.txtFollows rules in the site's robots.txt file, which may prevent some pages from being crawled. Enable Smart CrawlSkips URLs that look like crawler traps: deep paths, excessive query parameters, repetitive path segments, calendar/archive walkers, and faceted-navigation combinations. Block Analytics TrackersBlocks pure analytics and ad-tracking requests (Google Analytics, Hotjar, pixels) for faster page loads. Does not affect page content or scan accuracy. Advanced Link DiscoveryAnalyses JS files and network traffic for links. More thorough but slower. Apply Smart Dedup & Coverage CapsSkips duplicate pages (by canonical URL or content fingerprint) and limits how many variants of the same path, locale, section or query string are scanned. Turn off to scan every URL without deduplication.

Text description: Crawl Options section with its default values

Example of the Crawl Options section: Max Crawl Depth Unlimited, Crawl Delay 0 milliseconds, Max Crawl Size 1000 pages, an empty Exclude URL Patterns field, Enable Parallel Processing unticked and Respect robots.txt, Enable Smart Crawl, Block Analytics Trackers, Advanced Link Discovery and Apply Smart Dedup and Coverage Caps ticked, each with its description.

• Max Crawl Depth: How many links away from the starting page the scanner travels. Unlimited by default.
• Crawl Delay: The time, in milliseconds, the scanner waits between loading pages. With Parallel Processing on, the delay applies across all workers together, so the website sees one request per delay rather than one per worker. Raise it if a site returns "429 Too Many Requests" errors. Default 0.
• Max Crawl Size: The total number of unique pages allowed in one report.
  • Default 1,000.
  • Only pages actually scanned count towards it, so addresses that are excluded, outside the site or skipped by a cap don't use up the limit, and neither do pages that turn out to be duplicates, error pages or files once they load. The address you entered is always included, even when the limit is small and a sitemap lists many pages.
  • For how addresses are deduplicated and why some pages are skipped, see pages you expected aren't scanned in the Troubleshooting Guide.
• Exclude URL Patterns: Stops the scanner visiting addresses that contain the text you enter, one pattern per line, for example /logout or /admin/.
  • Matching ignores letter case.
  • Use * as a wildcard, or write a regular expression between slashes, such as /\/admin\//. A pattern between slashes is treated as a regular expression only if it contains regular-expression characters, so /admin/ matches that text exactly.
  • A regular expression that could take too long to check, such as one with nested repeats, a repeated group containing alternatives like (a|b)+, or three or more .*, is matched as plain text instead, and only the first 512 characters of an address are checked against regular expressions.
• Enable Parallel Processing: Scans several pages at once in separate browser tabs.
  • It is faster but uses more resources, and some sites block it.
  • While it is on, Interactive Mode, User Journey, Adaptive Networking and Periodic Browser Restarts are unavailable, Pause is hidden and Finish Early & Scan is unavailable. Entering a Login URL or turning on Persistent Session turns Parallel Processing off.
  • Not available in Interactive Mode or for local files. A User Journey, a Login URL or Persistent Session also makes it unavailable.
• Concurrency: The number of pages scanned at once when Parallel Processing is on. Default 4. Whatever value you choose, it is capped to suit your computer's memory:
  • Under 4 GB of RAM: 1 page at a time.
  • 4 GB to under 8 GB: 2.
  • 8 GB to under 15 GB: 4.
  • 15 GB or more: 8.
• Respect robots.txt: Follows the Allow and Disallow rules in the site's robots.txt file, which may stop some pages being crawled.
  • The rules also apply to sitemap addresses, listed addresses and linked PDFs. If robots.txt isn't found, the scanner tries the www or non-www version of the address, and it waits up to 15 seconds for a reply, or the Request Timeout if you have set one.
  • If the site's server returns an error for robots.txt, or it can't be reached after a second try, the whole site is treated as off-limits, as the robots.txt rules require, and the Activity Log says so. If robots.txt is very large, only its first 512 KB of rules are used.
  • The site's Crawl-delay is used only when your own Crawl Delay is 0, and is capped at 30 seconds.
  • On by default.
• Enable Smart Crawl: Skips addresses that look like crawler traps: deep paths, too many query parameters, repeated path segments, calendar and archive walkers and faceted-navigation combinations.
  • The trap filter never skips the start address, addresses you list or sitemap addresses, but the other checks on this page can still skip them. For every reason a page can be skipped, see the skipped pages reference.
  • It also turns on near-duplicate sampling: pages that share their structure with a page already scanned, such as hundreds of products built from one template, skip the audit and are listed in the report as "represented by [URL]".
  • The trap thresholds, but not the near-duplicate checks, can be changed under Backend Fine-Tuning.
  • On by default.
• Block Analytics Trackers: Blocks requests to around 45 analytics and ad-tracking services, such as Google Analytics, Hotjar, Clarity and social media pixels, so pages load faster. It doesn't affect page content or scan accuracy. Services that can show visible content, such as tag managers, social media embeds and recommendation widgets, aren't blocked, and neither is the website you're scanning. On by default.
• Advanced Link Discovery: Analyses JavaScript files, watches background network traffic and follows route changes in single-page applications to find addresses that aren't in standard links. More thorough but slower. On by default.
• Apply Smart Dedup & Coverage Caps: The main switch for all deduplication and coverage limits: pagination and search caps, path-template caps, locale variant caps, section budget caps, canonical URL deduplication, content fingerprint deduplication and skipping thin or soft-404 pages.
  • Every skipped page is listed in the report with its reason.
  • Turn it off, together with Enable Smart Crawl, when every address must be audited individually, for example as compliance evidence. Pages that look like "not found" pages are still skipped unless Skip Pre-Scan Content Check is on.
  • On by default.
• Pagination cap (per base path): The maximum number of pagination, filter and sort variants, such as ?page=2, ?sort=price or ?colour=red, scanned for the same base address while caps are on.
  • Other query strings don't count, and an address with a single number, such as ?id=12, ?p=12, ?page_id=12 or ?post=12, is scanned as a page of its own.
  • Links on numbered pages over the cap are still followed, so pages listed only on later pages of a list are still found.
  • From 1 to 50.
  • Default 3. (Visible when Show All Settings is on)
• Search-query cap (per base path): The maximum number of ?q=-style search variants scanned for the same base address while caps are on. From 1 to 20. Default 1, because one representative search page is usually enough. (Visible when Show All Settings is on)
• Section budget cap (per top-level path): The maximum number of pages scanned from one top-level section, such as /products/, so one large catalogue can't use up the whole page budget. From 1 to 9,999. Default 200, raised automatically up to 1,000 for sections whose pages are genuinely varied. (Visible when Show All Settings is on)
• Locale variant cap (per locale): The maximum number of pages scanned for each non-primary locale, such as /de-de/ or /en-us/.
  • A folder only counts as a locale if it starts with a language code, and on websites whose own pages have no language folder, only once at least three language folders have been found. This stops sections such as /hr/ or /it/ being capped on a single-language website.
  • From 1 to 9,999.
  • Default 5, enough to catch locale-specific issues such as a wrong language declaration without re-auditing identical copies. (Visible when Show All Settings is on)

---

4. Scan Behaviour

Found under Customise Scan > Scanning. These options change the page before the audit runs and add extra audit passes. They are unavailable in Interactive Mode.

• Attempt to Dismiss Overlays (Cookies, etc.): Finds and selects buttons such as "Accept Cookies", "Close" or "I Agree" to clear pop-ups before scanning, including banners built as web components.
  • Only buttons inside a pop-up, banner or other overlay are selected, so buttons in the page itself, such as "Accept invitation", are left alone. Buttons whose name suggests they would log out, delete, buy, pay, submit, send, sign up, subscribe or close an account are never selected.
  • The Before you scan message calls this setting Overlay Dismissal.
  • On by default.
• Force-Reveal Hidden Content For Scanning: Makes fade-in and scroll-triggered content render, and expands accordions, tabs and <details> elements.
  • The page is then checked both expanded and collapsed, and the results are merged without reporting anything twice.
  • It also removes smooth-scroll wrappers such as Lenis, overrides content-visibility: auto, and lifts hidden and aria-hidden attributes set on landmark and heading ancestors. This prevents false "missing landmark" reports on animated sites.
  • On by default.
• Scan Dark Mode: Switches the page to its dark colour scheme and runs a second audit, but only if the page has a dark theme: its style sheets include dark colour scheme rules, or its main areas, such as html, body, main, header or footer, actually change colour.
  • This catches contrast problems in dark themes without false positives on light-only sites.
  • The main audit always uses the light colour scheme, even when your computer is set to dark mode. The extra audits Deep Scan runs after each interaction use the light scheme only.
  • On by default.
• Enable Content Interaction (Deep Scan): Selects interactive elements that aren't links, such as tabs and accordions, to reveal and scan content that is hidden when the page loads, including controls inside web components (Shadow DOM).
  • Buttons whose name suggests they would log out, delete, buy, pay or submit something, among others, are never selected, and form submit and reset buttons are skipped. The full list is in Protect the account.
  • A re-scan runs whenever an interaction changes the page, including switching between tab panels of a similar size. Much slower on busy pages.
  • Not used for a User Journey, because clicking could undo steps the journey has completed.
  • Off by default. (Visible when Show All Settings is on)
• Interaction Limit: The maximum number of elements Deep Scan selects on each page, to keep scan times reasonable. Default 15. (Visible when Show All Settings is on)
• Crawl Site Even When Sitemap Provided: When a Sitemap XML URL is set, also crawls the site to find pages the sitemap leaves out. Turn it off to scan only the pages in the sitemap. On by default.

---

5. Viewport & Device

Found under Customise Scan > Scanning. These settings choose the screen size and identity of the scanning browser.

Viewport & Device Emulation Mode: Standard ViewportDevice PresetCustom Device Standard Viewport Preset:Small Desktop (1280x800) Scan All Viewports (Desktop, Tablet, Mobile)Scans 4 viewports per page (Desktop 1280, Desktop 1920, Tablet 768, Mobile 375). Slowest option. Scan Mobile & Desktop OnlyScans 2 viewports per page. Default balanced option. Run Viewports In ParallelScans the selected viewports of each page simultaneously instead of one after another. Faster but uses more memory. Disable if the target site blocks parallel requests.

Text description: Viewport and Device section with its default values

Example of the Viewport and Device section: Emulation Mode set to Standard Viewport, with Device Preset and Custom Device as the other choices; Standard Viewport Preset showing Small Desktop (1280x800), greyed out while a multi-viewport option is on; Scan All Viewports (Desktop, Tablet, Mobile) unticked; Scan Mobile and Desktop Only ticked; and Run Viewports In Parallel ticked, each with its description.

• Emulation Mode: Choose Standard Viewport for responsive widths, Device Preset for exact emulation of a real device, or Custom Device to define your own.
• Standard Viewport Preset: The single screen size used when neither multi-viewport option is on: Small Desktop (1280x800), Large Desktop (1920x1080), Tablet (768x1024) or Mobile (375x667). Small Desktop is selected by default.
• Scan All Viewports (Desktop, Tablet, Mobile): Audits every page at all four standard sizes to catch responsive design failures. The slowest option.
• Scan Mobile & Desktop Only: Audits every page twice, at Desktop (1280x800) and Mobile (375x667), balancing speed and coverage. On by default.
• Run Viewports In Parallel: Scans the selected viewports of each page at the same time rather than one after another. Faster for most sites, but uses more memory. Turn it off for sites with strict bot protection or computers with little memory. On by default.
• Device Preset: A specific device to emulate, such as an iPhone (including the iPhone 17 range and iPhone Air), a Pixel (including the Pixel 9 range) or a MacBook. Android presets identify as the version of Chrome the scanner uses, in the same way a real Android phone does.
• Custom Device: Set your own Width and Height in pixels, Scale Factor and User Agent. Is Mobile identifies the browser as a mobile device, which changes how some sites render, and Has Touch turns on touch events, which matters for mobile menus and gestures.
• Checks: Device settings are checked before the scan starts. Interactive Mode uses the device or viewport you choose.

---

6. Axe Scan Rules

Found under Customise Scan > Scanning. These settings configure the axe-core rules engine and the Needs Review items in reports.

Axe Scan Rules Axe Tags WCAG 2 AWCAG 2 AAWCAG 2.1 AWCAG 2.1 AA WCAG 2.2 AWCAG 2.2 AAWCAG 2 AAAWCAG 2.1 AAA WCAG 2.2 AAABest PracticeSection 508EN 301 549 Trusted TesterRGAA 4Review ItemsExperimental

Text description: Axe Tags under Axe Scan Rules, with the default tags ticked

Example of the Axe Scan Rules section showing Axe Tags: WCAG 2 A, WCAG 2 AA, WCAG 2.1 A, WCAG 2.1 AA, WCAG 2.2 A, WCAG 2.2 AA and Best Practice ticked; WCAG 2 AAA, WCAG 2.1 AAA, WCAG 2.2 AAA, Section 508, EN 301 549, Trusted Tester, RGAA 4, Review Items and Experimental unticked.

• Axe Tags: The standards to test against: WCAG 2.0, 2.1 and 2.2 at Level A, Level AA and Level AAA, Best Practice, Section 508, EN 301 549, Trusted Tester, RGAA 4, Review Items and Experimental.
  • By default, WCAG 2.0, 2.1 and 2.2 at Level A and Level AA are selected, with Best Practice.
  • The setup walkthrough's recommended answer, WCAG 2.2 + Best Practices, also adds EN 301 549.
  • For what each standard covers, see which standards can be selected in Scope of Automated Testing.
• Trusted Tester: The automated checks that correspond to the Trusted Tester process used for US federal accessibility testing.
• RGAA 4: The rules that correspond to the criteria of the French accessibility framework, RGAA 4.
• Review Items: Rules that always need a person to confirm the result, rather than passing or failing on their own. Their findings are only ever reported as Needs Review items, so this tag and Include Needs Review Section are linked: turning on either one turns on the other.
• Include Needs Review Section: Under Manual Review Settings.
  • Includes items axe-core can't verify automatically and that need a manual check, such as colour contrast over images.
  • They are kept apart from confirmed issues, even for the same rule, so a page with one confirmed contrast failure still lists its other uncertain contrast items for review.
  • In the finished report you can Approve or Remove each one, as described in Report Anatomy, Interactive review and triage section. Linked to Review Items.
  • Off by default.
• Disable Specific Rules: A searchable list of rules to turn off.
• Run ONLY These Rules: A searchable list of rules to run instead of the full set.

---

7. Screenshots & Reporting

Found under Customise Scan > Reporting.

Screenshots & Reporting Report Format HTML (Default)CSVJSON Screenshot Mode Per Instanceevery issuePer Issue Typeone per ruleDisabledno screenshots Stamp ScreenshotOverlays an information panel on the screenshot containing the Issue ID, rule description, primary recommendation and the offending HTML snippet. Simplified Screenshot NamesNames each screenshot after the page and what was found, rather than the full technical name. OffHome_Desktop_1280x800_evidence1_color_contrast_1.4.3.pngOnHome - Contrast.png

Text description: Screenshots and Reporting section with its default values

Example of the Screenshots and Reporting section: Report Format set to HTML (Default), with CSV and JSON as the other choices; Screenshot Mode set to Per Issue Type, one per rule, with Per Instance, every issue, and Disabled, no screenshots, as the other choices; Stamp Screenshot ticked; and Simplified Screenshot Names ticked, comparing the name Home_Desktop_1280x800_evidence1_color_contrast_1.4.3.png when off with Home - Contrast.png when on.

• Report Format: HTML (Default) for an interactive report, CSV for spreadsheets or JSON for connecting to other systems.
  • Screenshots and ticket content are only available in HTML reports, so choosing CSV or JSON turns off Screenshot Mode and Generate Ticket Content. Switching back to HTML restores the values they had before.
  • CSV and JSON reports are saved only once they are complete.
  • Every HTML scan also produces a companion CSV with every instance, untruncated, that shares the report's file name, and a screenshots ZIP whenever screenshots are captured. For the contents of each format and how report files are named, see report formats and file names.
• Screenshot Mode: Per Instance captures each issue, up to 50 per issue type on each page, which makes reports much larger and scans much longer.
  • Further instances are listed without screenshots, the report notes where this applies, and the Activity Log shows progress while screenshots are captured.
  • Per Issue Type captures one example per rule and is the default. Disabled captures none.
  • Screenshots are lossless PNG images. When a scan has more than 400 screenshots, or more than 100 MB of them, they are saved to a folder next to the report instead of being embedded.
  • Screenshots show whatever the page displayed, including any real names, emails or account details, so choose Disabled when the site shows confidential or production user data. On very large scans, new screenshots stop once 150,000 issue instances have been found, and the Activity Log says so. See Activity Log messages.
• Stamp Screenshot: Overlays a panel on each screenshot with the rule ID, the rule description, the main recommendation and the failing HTML snippet. The panel is placed at the top or bottom so it doesn't cover the highlighted element. On by default. Unavailable when Screenshot Mode is Disabled or the report format is CSV or JSON.
• Simplified Screenshot Names: Names each screenshot after the page and what was found, such as Home - Contrast.png, rather than the full technical name. Long names are shortened and repeated names are numbered, so nothing is overwritten. On by default. Unavailable when Screenshot Mode is Disabled.
• Generate Ticket Content: Creates a structured, ready-to-paste ticket for every issue. For what a ticket contains, see Tickets in Report Anatomy. On by default.
• Show Every Instance Of Every Rule: By default, the HTML report keeps up to the first 1,000 instances of each rule (fewer on very large scans or when memory runs low, down to 50) so it stays manageable on computers with little memory.
  • Turn it on to keep every instance, which suits compliance audits but is only safe with plenty of memory.
  • The companion CSV always contains every instance.
  • Off by default.

For large or slow reports, screenshots saved to a folder and CSV-only results, see Reports, in Troubleshooting Guide in the Troubleshooting Guide.

Local LLM Review

Found under Customise Scan > Local AI (Optional). An optional feature, off by default, that sends page details from a scan to an LLM server you run on your computer or your local network, such as Ollama or LM Studio. Day to day, Octopus Scanner uses no AI, your scan data stays on your computer, and cloud AI providers aren't accepted.

• Enable Local LLM Review: Turns the review on and shows its main settings: the server, Find a Server, Test Connection, the model and the categories. The rest appear with Show All Settings, and a hidden connection setting, such as API Key, is shown on its own when it needs attention. Off by default. Every setting is described in Local LLM Review, The settings section.
• Model: Until models are listed, shows Select Test Connection to list models. Test Connection, or Use after Find Servers, lists your server's models. Choose Other model to enter a name in Model Name instead.
• Find Servers and Search Local Network: Look for LLM servers on this computer, or on other devices on your local network, and list each one with a Use button that fills in its details. They run only when you select them, Search Local Network asks first, and your API key is never sent while searching.
• Categories: What to look for when finding issues axe-core can't detect.
  • Page Content covers alt text, link and button text, headings, labels, forms, label in name, page title, language, sensory instructions, reading order, consistency and captions and transcripts. Visual covers text over images, use of colour, images of text and non-text contrast, from screenshots. Interaction covers Focus Visible, which presses Tab through each reviewed page, and Form Errors, which checks form validation messages without typing, submitting or sending anything.
  • All are on by default, and Interaction checks make scans take longer.
  • Unavailable while Find Issues axe-core Can't Detect, under What To Review (Visible when Show All Settings is on), is off.
• What it adds to reports: A second opinion on axe-core findings in each ticket, and a separate LLM Review section of suggestions to approve or remove. LLM findings are suggestions, not confirmed issues.

For setting up a server, every setting, what is sent and how to read the results, see Local LLM Review, top of the page.

---

8. Advanced Options

Found under Customise Scan > Advanced.

• Exclude CSS Selectors: Parts of the page for the rules engine to ignore, such as .third-party-chat-widget. (Visible when Show All Settings is on)
• Navigation Timeout: The longest time, in milliseconds, the scanner waits for each page to load before recording it as an error and moving on. Default 60,000 (60 seconds). If Crawl Page Timeout is set under Backend Fine-Tuning, it takes priority for page loads during a crawl. (Visible when Show All Settings is on)
• Wait Before Scan: What the scanner waits for before the audit starts: Default, a fixed Timeout in milliseconds of up to 2 minutes, or a Selector, which waits for the CSS Selector you enter to appear. (Visible when Show All Settings is on)
• Proxy Server URL (Optional): Routes traffic to the scanned site through an HTTP, HTTPS, SOCKS4 or SOCKS5 proxy, including the scanner's own robots.txt and sitemap requests.
  • A username and password in the proxy address are used for robots.txt and sitemap requests, and for the scanning browser on scans of public websites. Scans that start on your local network connect the browser to the proxy without signing in.
  • On public websites, every browser connection is checked against private network addresses before it reaches the proxy, so a scanned site can't use your proxy to reach devices on your network. Addresses on your own computer, such as localhost, are always loaded directly.
  • When a proxy is set, the Before you scan message names the proxy, so a proxy added by an imported configuration doesn't go unnoticed. For proxy problems, see proxies in the Troubleshooting Guide.
  • (Visible when Show All Settings is on)
• Allowlist Header Name and Value (Optional): A header, such as X-Octopus-Scan, with a secret value of your choosing, added to every request to the website you're scanning, including the scanner's own robots.txt and sitemap requests.
  • The website's team can tell their firewall or bot protection to let requests with this header through.
  • It goes only to the website you entered, never to other websites the pages load content from or redirect to. The value isn't saved with your settings or configurations, and never appears in logs or reports.
  • See Let the scanner through bot protection.
  • (Visible when Show All Settings is on)
• Skip Pre-Scan Content Check: Skips the check that confirms an address is an HTML page. Use it for local files or servers that don't report text/html correctly. Off by default.
• Scan Iframes: Scans content inside <iframe> and <frame> elements, including frames from other sites, and reports their findings and screenshots like any other issue. It can add a lot of time on pages with many frames. Frames that can't be reached are reported as not tested. On by default.
• Check PDFs: An experimental check that downloads linked PDFs, including ones that download instead of opening, and checks each one against core accessibility requirements: tags, a text layer, security settings that block screen readers, a document title and whether it is shown in the title bar, a document language, alternative text for images, headings, table headers, form field names, tagged links, tab order and bookmarks in long documents.
  • Each problem found appears in the report's PDF Checks section with its WCAG criterion and how to fix it, and in the companion CSV. Encrypted or damaged PDFs are reported as Couldn't be checked.
  • Only PDFs on the website being scanned, including its other subdomains, are checked, up to 500 per scan, with the Crawl Delay between each one. It doesn't check whether the tags, reading order, colour contrast or alternative text are correct.
  • See PDF checks.
  • On by default.
• Persistent Session: Keeps cookies, local storage and sign-ins between scans, so you can stay signed in across several runs.
  • Off by default, but entering a Login URL turns it on until you turn it off again.
  • While it is on, Parallel Processing is turned off and unavailable.
  • Once it hasn't been used for 30 days, Octopus Scanner resets it the next time it starts, and you can clear it at any time with Clear Session under Options.
  • Because it stores live sign-ins on this computer, clear it after scanning anything sensitive, especially on a shared computer.
• Run Axe on 'Document': Scans the whole document. Turning it off limits the audit to the page body, so the rules for page language (html-has-lang, html-lang-valid, valid-lang) and meta-viewport can't run. On by default.
• Periodic Browser Restarts: Restarts the browser at set intervals on large scans to clear memory and prevent crashes. On by default. Not available with Parallel Processing, Interactive Mode or a Login URL.
• Adaptive Networking: If a site starts blocking or slowing the scan, increases the delay between pages, then restores speed once things settle. If Stealth Mode is on, it also strengthens stealth protections. If Stealth Mode is off, it stays off and the scan progress suggests turning it on. On by default. Not available with Parallel Processing.
• Disable GPU Acceleration: Renders without GPU acceleration, which can improve stability and reduce resource use, particularly on servers and virtual machines. On by default.
• Stealth Mode: Hides automation signals and presents the scan as an ordinary copy of Chrome on your computer, with a matching user agent and browser hints, your language and a realistic screen size.
  • It also varies the pause between pages, tells the website which page linked to the next and visits the home page first, so scans are harder to single out.
  • It never changes the pages being scanned.
  • On by default.
• Handle Trusted Types: A compatibility fix for sites whose strict Content Security Policy would otherwise stop the rules engine running. On by default.

---

9. Backend Fine-Tuning

Found under Customise Scan > Advanced. Low-level settings for experienced users. Wrong values can make scans unstable or fail. Leave a field blank to use its default. (Visible when Show All Settings is on)

• Timeouts: Axe Timeout, Sitemap Timeout, Request Timeout, Crawl Page Timeout, Wait For Selector Timeout and Puppeteer Protocol Timeout, all in milliseconds. Crawl Page Timeout overrides Navigation Timeout for page loads during a crawl and must be at least 1,000 (1 second). Leave it empty to use Navigation Timeout.
• Pages Per Restart: How many pages are scanned between Periodic Browser Restarts. Default 25.
• Retries: Retry Attempts, Retry Initial Delay, Retry Delay Factor, Bot Block Multiplier and Task Short Delay control how failed page loads and blocked requests are retried.
• Adaptive Networking tuning: Adaptive Error Threshold, Adaptive Max Delay, Adaptive Increment and Adaptive Success Reset control how quickly Adaptive Networking slows down and recovers.
• Smart Crawl thresholds: Tune the trap detection behind Enable Smart Crawl. To scan more of a site with genuinely deep paths or complex filtering, raise Max Query Params or Max Path Depth, or lower Repetitive Path Threshold. Do the opposite to skip more addresses that look like traps.
  • Smart Crawl Max Query Params: Addresses with more query parameters than this are treated as traps. Default 5.
  • Smart Crawl Max Path Depth: Addresses with more path segments than this are treated as traps. Default 10.
  • Smart Crawl Repetitive Path Threshold: A value between 0 and 1. If the ratio of unique path segments to total path segments falls below it, the address is treated as a trap. Checked only on addresses with more than four path segments. Default 0.5.
• Custom Stealth User Agents: Your own list of user agents for Stealth Mode to rotate through, one per line.
• Custom Browser Launch Arguments: Extra Chrome options, one per line. Only options on a fixed safe list are applied. Anything else, such as turning off Chrome's sandbox, is ignored.

---

10. Save & Load Configurations

Found under Customise Scan > Saved Settings. Configurations are kept in the scanning interface's local storage on this computer and remain between launches.

Save & Load Configurations Saved Configurations:Mobile WCAG AA Scan Load SelectedDelete Selected Save Current Configuration As:e.g., 'Mobile WCAG AA Scan' Save Make this my default configuration Import & Export via File:Export your configuration to share, or import one you've been sent. Export CurrentImport File

Text description: Save and Load Configurations section, showing the configuration Mobile WCAG AA Scan

Example of the Save and Load Configurations section: a Saved Configurations list showing Mobile WCAG AA Scan, with Load Selected and Delete Selected buttons; a Save Current Configuration As field, empty, with a Save button; an unticked Make this my default configuration checkbox; and Import and Export via File with Export Current and Import File buttons.

• Save Current Configuration As / Save: Stores your entire setup, including advanced and fine-tuning settings, under a name you choose. If the name is already in use, you are asked before it is overwritten. Sensitive Values are never saved. Other typed journey values, and any username and password in the website or proxy address, are saved as typed on this computer, but are left out of exported files.
• Make this my default configuration: Tick it before you select Save to load that configuration automatically every time you open the scanner. If you save your current default again without ticking it, it stops being the default.
• Saved Configurations: Choose a saved configuration, then select Load Selected to apply it or Delete Selected to remove it.
• Export Current: Under Import & Export via File.
  • Downloads the current settings as a JSON file for another computer or a teammate.
  • Sensitive Values and the Allowlist Header value are left out, as are usernames, passwords and sign-in values in addresses (the start address, Login URL, Proxy Server URL, Sitemap XML URL, Scan Specific URLs and journey Go to URL steps). Sign-in values are query parameters such as token, code, state and api_key. If anything was left out, the confirmation says so, so you can enter it again after importing.
  • The file also records which version of Octopus Scanner exported it.
• Import File: Restores settings from a JSON file exported from Octopus Scanner, or from a report's Export Settings. It only fills in the form, so select Save to keep the settings as a configuration. Settings missing from the file fall back to their defaults. If the file came from a different version, a message says some settings may not apply correctly.

What the interface remembers

The scanning interface keeps these on this computer between launches:

• Configurations: Your saved configurations, and which one is your default.
• Appearance: The Theme you chose and whether Show All Settings is on.
• Before you scan: Whether you selected Continue and don't show this again.
• Setup walkthrough: Whether you closed it without finishing, so it doesn't open by itself again.

Preferences > Data > Reset Data in the Octopus Server window clears all of these.

---

11. Scan progress and past reports

Scan Progress appears below the controls while a scan runs.

Scan Progress Visual Scanner Progress https://www.example.com/ Time RemainingCalculating(Rough estimate) Issue Types5 Pages Scanned11 crawled Network Traffic0.0 MB7 requests Node Engine46.3 MB Activity Log

Text description: Scan Progress panel during a scan, with the live view of the scanning browser and scan statistics

Example of the Scan Progress panel: a progress bar; an open Visual Scanner Progress section showing the live scanning browser on https://www.example.com/; cards for Time Remaining (Calculating, rough estimate), Issue Types 5, Pages Scanned 1 of 1 crawled, Network Traffic 0.0 MB from 7 requests, and Node Engine 46.3 MB; and a collapsed Activity Log.

• Progress bar: Fills as the scan runs, with moving stripes.
  • Select Pause animation to stop the stripes and Play animation to start them again. Your choice is remembered, and the stripes don't move if your system is set to reduce motion.
  • Point at it or move keyboard focus to it to see the percentage, and press Escape to hide it again.
  • Screen readers hear the progress at any time, and messages such as Cancelled or Connection lost always show.
• Visual Scanner Progress: A dropdown showing a live view of the scanning browser, updating up to eight times a second while pages load, scroll and change, so you can follow the scan as it moves through the site.
  • When the view is narrower than the panel, such as a phone, a soft blurred copy fills the space either side. With Parallel Processing it follows the page most recently opened.
  • While PDFs are checked, Local LLM Review runs or the report is being built, there is no page to show, so the panel says which of these is happening instead.
  • The feed only runs while the dropdown is open. It opens when a scan starts and closes when it finishes.
  • Available for HTML reports with screenshots turned on, and not shown in Interactive Mode.
• Time Remaining: A rough estimate of how long the scan has left. When the scan ends, it becomes Total Duration. If the scan was cancelled or stopped, it says Cancelled or Stopped instead of a time.
• Issue Types: The number of distinct issue types found so far.
• Pages Scanned: The number of pages scanned so far. A line below shows how many pages were crawled and, when they apply, how many were discovered and how many duplicates were skipped.
• Network Traffic: The data transferred by the scan so far, in MB.
• Node Engine: The memory the scanning engine is using, in MB. When the scan ends, it shows the size of the finished report, or No report if the scan was cancelled or stopped.
• Activity Log: A dropdown with a running log of everything the scan is doing. It keeps the latest 200 entries. For what the messages mean, see Activity Log messages. Select Pause auto-scroll to read earlier entries while the scan continues, and Resume auto-scroll to follow new entries again.
• Connection lost: When Connection Recovery is on in Preferences > Options and the connection drops during a scan, a notice explains that the scan is paused and will continue automatically when the connection returns. You can also resume or cancel it with the buttons above.

Scan Complete View ReportDownload CSVDownload Screenshots

• Scan Complete: For HTML scans, shows View Report, with downloads for the companion CSV and the screenshots ZIP.
  • For CSV and JSON scans, the button reads Download CSV Report or Download JSON Report and downloads the file.
  • If no pages could be loaded, it reads No Pages Could Be Scanned and says why, for example that the site blocked automated scanning, refused access or needs a sign-in. See No pages could be scanned.
  • If you finish an Interactive Mode session without scanning a page, it reads No Pages Were Scanned.
• Past Reports: Lists previous reports by site, with the date, size and format of each, and its own Download and Delete buttons.
  • The heading shows how many reports there are and their total size.
  • When you delete an HTML report that has a companion CSV, you are asked whether to delete the CSV too: OK deletes both, and Cancel keeps the CSV. Deleting a report also removes its screenshots.
  • Only files whose names start with accessibility_report_ are listed, so a renamed report no longer appears. Long lists show 20 at a time, and a button such as Show 20 More reveals the next 20.
  • Reports are never deleted automatically.
• Search Reports: Filters Past Reports by site name or by the date as shown in the list. Its label shows the number of reports, such as "Search 12 Reports".
• Remove Reports: Choose an age, from Older than 7 days to Older than 180 days (7, 30, 90 or 180), then select the delete button, which shows how many reports will go and how much space they take, such as "Delete 3 reports (24 MB)".
  • After you confirm, those reports, their companion CSVs and their screenshots are removed.
  • It appears once a report is at least 7 days old, and offers only the ages that apply.

---

12. Footer and options

The buttons at the bottom of the scanning interface.

DonateAutoOptions

• Donate: Opens a short note about donations, which are optional. Every feature is available with or without one. Open Buy Me a Coffee opens the project's Buy Me a Coffee page in your browser.
• Theme: Switches the scanning interface between Auto, which follows your system, Light and Dark.
• Options: Shows the following buttons.
  • Support: Brings the Octopus Server window forward and opens its Support page.
  • Folders: Choose Reports Folder or Session Folder to show where that folder is on your computer.
  • Show All Settings: Shows the settings that are hidden by default, which are marked throughout this guide. If one of these hidden settings has a problem when you start a scan, Show All Settings turns on so you can see and fix it. In Local LLM Review, only the setting that needs attention is shown instead.
  • Clear Session: Deletes the saved Persistent Session, signing the scanner out of any sites. Not available while a scan is running. (Visible when Show All Settings is on)
  • Report Bug: Opens a message with Open email, which starts a pre-filled email in your email app, and an option to copy the address and template instead. For what to include, see the Troubleshooting Guide, Check the logs first section.

Settings that apply to the whole app, rather than to a single scan, are in Preferences in the Octopus Server window.

---

13. Reports

An HTML report opens with a header showing the audited site, the date and the number of pages scanned, with Export Coverage, theme and search buttons and Export Settings when the report includes its scan settings. Below it are At a Glance, Top Issues & Pages, Issue Overview, the severity tabs under Accessibility Issues Found, Additional Information and Report Tools.

Accessibility Scan Report Audited site https://www.example.com/ 16 Oct 2026, 17:12 · 3 pages scanned Export CoverageExport Settings

Text description: a report header titled Accessibility Scan Report, with the audited site, scan date and report buttons

Example of a report header titled Accessibility Scan Report, with the audited site https://www.example.com/, the date and 3 pages scanned, and Export Coverage, theme, search and Export Settings buttons.

Every part of the report, including tickets, Move To, Approve and Remove, Enable Editing, Save & Download HTML and the exports, is explained in Report Anatomy, top of the page. For how to act on what you find, see After Your Scan.

---

14. The Octopus Server window

The desktop window runs the scanning engine, reports what it is doing, and holds the settings that apply to the whole app rather than to a single scan. The scanning interface opens from here in its own window.

Octopus ServerOctopus ServerCPU 2%RAM 310 MBDISK 1.1 GBSystem ActivityRequesting An Octopus From The SeaThe interface opens on its own once the scanner is ready.Waiting for the interface to answerShow System ActivityOpen InterfaceExitPreferences

Octopus ServerCPU 2%RAM 310 MBDisk 1.1 GBSystem ActivityRequesting An Octopus From The SeaThe interface opens on its own once the scanner is ready.Waiting for the interface to answerShow System ActivityOpen InterfaceExitPreferences

Text description: Octopus Server window on Windows while the scanner starts

Example of the Octopus Server window on Windows. At the top are the Octopus Server title and CPU, RAM and Disk usage. The System Activity panel reads Requesting An Octopus From The Sea, The interface opens on its own once the scanner is ready, and Waiting for the interface to answer, with a Show System Activity button. Open Interface, Exit and Preferences buttons run along the bottom.

Text description: Octopus Server window on macOS while the scanner starts

Example of the Octopus Server window on macOS. At the top are the Octopus Server title and CPU, RAM and Disk usage. The System Activity panel reads Requesting An Octopus From The Sea, The interface opens on its own once the scanner is ready, and Waiting for the interface to answer, with a Show System Activity button. Open Interface, Exit and Preferences buttons run along the bottom.

• Status strip: The latest status line from the engine appears in a strip under System Activity.
  • On Windows, changes of status, such as Initialising..., Starting..., Active, Scanning..., Updating..., Offline (Code N), Crash loop — stopped and Stopped: unsafe component, are also announced to screen readers. In Offline (Code N), N is the exit code the engine stopped with.
  • For what the window's messages mean, see Octopus Server window messages.
• Requesting An Octopus From The Sea: Shown in place of System Activity while the engine starts, when Open Interface Automatically is on, naming each step as it happens.
  • Show System Activity switches to the log instead.
  • If the engine stops, can't claim its port or never answers, the screen says so rather than continuing to report progress, and on macOS it offers Restart Scanner.
  • On macOS, when Octopus Scanner is kept in Documents, Desktop, Downloads or iCloud Drive, macOS asks for permission before the app can read its own files, and the screen shows Permission Required until you select Allow.
• CPU, RAM and Disk: Live CPU and memory use while the scanner runs, and the disk space Octopus Scanner and its reports take up.
• System Activity: Everything the engine reports, including warnings and errors. A button beside the heading stops or resumes following new entries. On macOS, if the engine stops, Scanner Stopped and a Restart Scanner button appear beside the heading. Save this session's log with Preferences > Data > Export Activity Logs.
• Open Interface: Opens the scanning interface. It reads Starting… and is unavailable until the engine has started, whether or not the interface is set to open on its own.
• Restart Scanner: Appears when the engine has stopped, and starts it again without quitting the app. On macOS it takes the place of Open Interface. On Windows it appears next to Open Interface, and if the engine stops unexpectedly after starting, Octopus Scanner restarts it by itself, up to three times in 10 minutes. See The scanner has stopped.
• Exit: Quits Octopus Scanner. It asks you to confirm only while the engine is running or starting, or an update is installing. If a scan is running, the message warns that quitting discards it. Completed reports stay in the reports folder.
• Preferences: Opens the settings pages described below: Options, Data, Release Notes, Support and Legal.

Defaults: Server Port 3000, Theme System, Always Show Descriptions off, Open At Login off, Open Interface Automatically on, Connection Recovery on, Idle Screen off (Start After 5 minutes, Layout Classic and on macOS Don't Show Over Full-Screen Apps on and Don't Show While Apps Keep the Display Awake off), and Official Update Notifications, Accessibility Engine Update Notifications and Component Update Notifications on.

The Octopus Server window on macOS

• Closing and quitting: Closing the Octopus Server window quits Octopus Scanner.
  • There is no menu bar mode.
  • While the engine is running or starting, closing the window, pressing Command+Q or choosing Quit from the Dock shows Quit Application? first. Logging out, restarting or shutting down your Mac quits Octopus Scanner without asking.
  • Closing the scanning interface window leaves the engine running.
  • Only one copy runs at a time: opening it again brings the open copy forward.
• Dock icon: Shows the percentage complete while a scan runs.
• Keyboard shortcuts: Command+O opens the scanning interface, Command+, opens Preferences and Command+R restarts a stopped engine, as does File > Restart Scanner.
  • In the scanning interface, Command++, Command+- and Command+0 zoom in, zoom out and return to actual size, as do the matching items in the View menu, and the zoom level is remembered. You can also pinch to zoom on a trackpad.
  • Esc closes Preferences pages and dialogs.
  • On the startup screens, Return selects the default button.
• Downloads and links: Downloads open a Save panel, and the saved file is then shown in Finder. Links to other websites open in your default browser, and reports open in their own windows.
• Open At Login: Octopus Scanner appears in System Settings > General > Login Items. If macOS asks you to approve it there first, the setting stays on and its description says it is waiting for your approval.
• Sleep: The Mac and its display stay awake while a scan runs.
• Idle Screen: Covers every display and hides the pointer.
• System Activity: Shows the latest 300 lines, or 1,500 while following new entries is stopped. Right-click it for Copy All. Export Activity Logs saves the whole session.
• Dropping a web address: Dropping a web address on the window opens it in your default browser.
• Component versions: The main Preferences page shows the installed versions of axe-core, Node.js and Puppeteer.

The Octopus Server window on Windows

• One copy at a time: Only one copy of Octopus Scanner runs. Opening it again brings the existing window forward.
• Closing and quitting: Closing the window quits Octopus Scanner rather than hiding it in the notification area. It asks you to confirm while the engine is running or an update is installing.
• Notification area: The Octopus Scanner icon is always shown there. Select it to bring the window forward, or right-click it for Show Octopus Scanner and Quit. When the engine has stopped, the menu also offers Restart Scanner. Quit asks for confirmation in the same way as closing the window.
• Notifications: When a scan completes while the window is minimised or not in use, a notification appears. Select it to open the report.
• Taskbar button: Shows the progress of a running scan.
• Keyboard shortcuts: Alt+O opens the scanning interface, Alt+P opens Preferences and Alt+R restarts a stopped engine. Esc closes Preferences, dialogs and notifications in the window. In System Activity, Ctrl+C copies the selection, and right-click offers Copy and Copy All.
• Reports and links: Reports open in their own Octopus Scanner windows, and links to other websites open in your default browser.
• Open At Login: Starts Octopus Scanner minimised. It appears in Task Manager > Startup apps.
• Idle Screen: Spans every monitor and hides the pointer. While a Windows contrast theme is on, it uses the Mono layout in your system colours.
• Component versions: The main Preferences page shows the installed versions of axe-core, Node.js and Puppeteer.

Startup screens

Before the main window appears, Octopus Scanner can show a series of screens. Most appear only once, or only when something needs your attention. They appear in this order.

1. Offline and update notices: If the computer is offline, "Looks like you're offline" explains: "Connect to get the latest updates. You can continue offline for now." Select Continue. This screen isn't shown when Offline Mode is on. When an update is available, its notice appears here, as described in Update notices.
2. Finish Installation (macOS): Appears when Octopus Scanner isn't running from the Applications folder. Quit & Move quits so you can drag the app into Applications and open it from there. Continue Anyway carries on from where it is.
3. Legal Information: Links to the Terms & Conditions and Third-Party Licences. Select Agree and Continue to use the app. Decline shows Access Declined, with a button to exit (Exit App on macOS, Exit on Windows). This screen appears again after Reset Data.
4. Updated or downgraded: After you install a different version, a screen confirms that Octopus Scanner has been updated or downgraded successfully, showing the PREVIOUS and NOW versions. If you had updated components, a Patched components removed panel explains that they apply only to the version they were installed with, and that the new version uses the components it ships with.
5. Updates: Three cards, Official Builds, Accessibility Rules and Component Updates, each with a toggle for its notifications.
   • Its description reads: "Security, bug and compatibility fixes between releases for the components Octopus Scanner runs on, such as Node.js. Each update waits 14 days after release and is checked before it installs. You can revert at any time." The number of days follows the waiting period you choose.
   • The toggles are the same settings as the Updates group in Preferences > Options, Official Update Notifications, Accessibility Engine Update Notifications and Component Update Notifications, and all three are on by default.
   • For how updates are kept safe, see How Octopus Scanner stays up to date in the Install Guide.
6. Security & Privacy: Explains how Octopus Scanner protects you: your data stays on your device, the packages it runs on, including axe-core, are checked against known malware every time it starts, dependency and Node.js updates are held back before they reach you, and pages you scan are kept away from the rest of your system.
   • You can set Component Safety Check and Offline Mode here, and a link opens the full Data, Privacy & Security page.
   • If you have used Octopus Scanner before, this screen appears once the next time it starts.
7. Getting Started: Lets you choose a few settings straight away, using the same controls as Preferences: the theme, Always Show Descriptions, Open At Login, Open Interface Automatically, Connection Recovery and Shut Down After Scan. Anything you choose here stays in place afterwards, except Shut Down After Scan, which applies only until Octopus Scanner closes.
8. Oops, Octopus feels confused: Shown once per version, 180 days after you first open that version, if Component Update Notifications are off and no update is available. It explains that without component updates the app can miss security, bug and compatibility fixes. Its toggle, Take it into our own tentacles, turns on Component Update Notifications.
9. Dependency notices: When dependency or Node.js runtime updates are ready and Component Update Notifications are on, a notice offers them, as described in Dependency Patching and Node Runtime.
10. Google Chrome missing: Octopus Scanner scans with Google Chrome.
    • If Chrome can't be found, Download Chrome opens the Chrome download page, Check Again looks for it again, and Continue Without Scanning opens the app so you can still view past reports. The check also runs again by itself when you return to the window.
    • On macOS, Chrome must be in Applications or in the Applications folder in your home folder.
    • On Windows, only the standard install folders under %LocalAppData%, Program Files and Program Files (x86) are checked, so Chrome Beta, Canary and portable copies aren't found.

The main window then appears. Everything you chose on these screens can be changed later in Preferences.

Preferences: Options

Grouped into General, Start Up, Scan Control, Optional and Updates, followed by a link to Advanced.

• General
  • Theme: System, Light or Dark, for the Octopus Server window. On macOS it also applies to the app's other windows and dialogs, including the Idle Screen.
  • Always Show Descriptions: Shows each setting's description all the time, instead of when you hover over or select it. Off by default.
• Start Up
  • Open At Login: Opens Octopus Scanner in the background when your computer starts, so scans and Idle Screen are ready when you need them. A start at login leaves the scanning interface closed until you open it. On Windows, a start at login doesn't wait at the startup screens: the engine starts straight away, and update notices wait until you next open Octopus Scanner yourself. If you move the app to another folder, Open At Login follows it. Off by default.
  • Open Interface Automatically: Opens the scanning interface as soon as the engine is ready. With it off, the engine still starts, and you open the interface with Open Interface. On by default.
• Scan Control
  • Connection Recovery: Pauses a scan while the connection is down and resumes it when the connection returns. Applies the next time the scanner starts.
  • Shut Down After Scan: Shuts the computer down when a scan finishes, after a 60-second wait so you can cancel. The countdown comes to the front of your other windows. Applies until Octopus Scanner closes, and is off again the next time it opens.
• Optional
  • Idle Screen: Opens the Idle Screen page below.
• Updates
  • Official Update Notifications: Tells you when a new tested release of Octopus Scanner is available.
  • Accessibility Engine Update Notifications: Tells you when a new version of the axe-core engine is available. Engine updates are offered as soon as they are released, with no waiting period, and are verified and installed only with your approval.
  • Component Update Notifications: "Get notified when dependency and Node.js runtime updates are ready." This is how Octopus Scanner stays current between releases. See Dependency Patching below. On by default, and recommended.
• Advanced: Opens the Advanced page below.

Preferences: Idle Screen

An optional display for when you step away from the computer.

• Idle Screen: Covers the display after a period of inactivity.
  • While a scan is running it shows the time remaining and progress. Otherwise it shows the time and date. It opens only after the inactivity period, not when a scan finishes.
  • If it is already showing when a scan ends, it changes to show that the scan is complete, or on Windows that the scan was cancelled or the scanner stopped. It closes when Shut Down After Scan starts its countdown.
  • When you dismiss it, you return to the app you were using. On Windows it doesn't appear over full-screen presentations or video, or while the computer is locked.
  • Off by default.
• Start After: How long the computer must be idle first: 1, 5, 10 or 15 minutes.
• Idle Screen Layout: Classic, Mono, Clock or Corner, each arranging the same information differently. Mono uses a plain black background.
• Keep Display Awake: Stops the display sleeping while Octopus Scanner is open, so Idle Screen can appear even if your system would turn the display off sooner. While it is on, your system's screen saver, display timeout and automatic lock may not start. Shown when Idle Screen is on.
• Don't Show Over Full-Screen Apps (macOS): Idle Screen won't appear while another app is full screen or presenting, such as a video, game or slideshow. Shown when Idle Screen is on. On by default.
• Don't Show While Apps Keep the Display Awake (macOS): Idle Screen won't appear while another app is keeping the display awake, such as during video playback. Apps that keep the display awake on purpose also stop it appearing. Shown when Idle Screen is on. Off by default.
• Idle Screen Preview: Shows the chosen layout straight away, with sample progress, without waiting for a scan.
• Not a lock screen: Idle Screen hides what is on screen but doesn't lock the computer, and doesn't replace your system's lock screen or display timeout. Any key press, click, scroll or mouse movement returns you to where you were.

Preferences: Advanced

Opened with Advanced at the end of Preferences > Options. Grouped into Network and Components. The page opens with "Advanced options. Most people never need to change these."

• Network
  • Server Port: The local port the engine listens on, from 1024 to 65535. Applies the next time the scanner starts.
  • Offline Mode: Stops Octopus Scanner contacting the internet on its own. Update checks, engine update checks, component safety checks and component update notices are paused, and Manual Patch and Manual Update are unavailable. Scans still reach the sites you scan. Off by default.
• Components
  • Update Dependencies: Installs updates to the components the scanner runs on. Manual Patch, or Patch Again after an update, opens the Dependency Patching screen. Revert returns to the components this version shipped with, and Restart Now completes it. Revert is unavailable while a patch or update is installing; try again when it finishes. On macOS, a dependency patch and a Node.js update can't run at the same time.
  • Node Runtime: Updates the Node.js runtime the scanner runs on. Manual Update, or Update Again once updated, opens the Node Runtime screen. Revert restores the runtime that ships with Octopus Scanner. It is unavailable while an update is installing; try again when it finishes.
  • Component Safety Check: Checks the packages the scanner runs on, including axe-core, against known malware and security issues every time Octopus Scanner starts, and again every 24 hours while it stays open. Turning it off also lets the scanner start when a component has been reported as malicious. Paused while Offline Mode is on. On by default. See Component Safety Check below.

Dependency Patching

Opened from Advanced, or from an update notice. Installs updates to the components Octopus Scanner runs on, which bring security, bug and compatibility fixes between releases. This is how Octopus Scanner is maintained each month, as explained in How Octopus Scanner stays up to date. The update notice says: "These updates have passed the waiting period, and each one is checked before it installs. Installing them keeps this installation current. You can revert at any time."

Your antivirus or security software may scan or briefly block new components while they install. See Antivirus and component updates.

Dependency Patching Updates the components Octopus Scanner runs on to newer versions that have passed the waiting period and safety checks, bringing security, bug and compatibility fixes between releases. You can revert at any time. Update LevelPatchMinorMajorAlso includes new features that stay compatible. Waiting Period7 Days14 Days (Recommended)30 DaysDependency and Node.js updates are only offered once they have been public for at least 14 days, giving the community time to spot problems. axe-core engine updates are offered as soon as they are released.

Text description: Dependency Patching screen, with Update Level set to Minor and Waiting Period set to 14 Days

Example of the Dependency Patching screen: the heading Dependency Patching with its description, an Update Level card with Patch, Minor and Major, Minor selected and the caption Also includes new features that stay compatible; and a Waiting Period card with 7 Days, 14 Days (Recommended) and 30 Days, 14 Days selected, explaining that dependency and Node.js updates are only offered once they have been public for at least 14 days, while axe-core engine updates are offered as soon as they are released.

• Update Level: Patch for bug and security fixes only, Minor to add new features that stay compatible, or Major to add major versions, which can change how the scanner behaves. Default Minor.
• Waiting Period: 7, 14 or 30 days. Updates are only offered once they have been public for at least this long, giving the community time to spot problems, such as a compromised release, before they reach you. Default 14 days, marked (Recommended).
• Components: One row per component, showing the current and new version, whether the change is a patch, minor or major update, and when it was published.
  • Switch off anything you don't want.
  • An update that fixes a high or critical security advisory reported for the installed version is marked Security fix and names the advisory, and the list says how many advisories the updates fix. Octopus Scanner confirms this by checking the new version against osv.dev too. If an advisory is in a component these depend on, the list says patching may fix it, and Octopus Scanner checks again afterwards.
  • Components that can't be updated say why, such as a version still inside the waiting period. axe-core isn't listed here, because it is updated separately through Engine Update Available.
• Manual Patch: Downloads and installs what you selected. If it can't run, a line below the button says why, such as a scan being in progress or nothing being available to install.
• Safeguards: Downloads come only from the official npm registry over HTTPS. Every package is checked against its published hash and signature, package install scripts are refused, the update is installed alongside the copy that shipped with the app, and the scanner must still start afterwards. If any check fails, the patch is discarded and nothing changes.
• Patch Applied: Lists what changed. It also says which security advisories the patch fixes, which stop applying when Octopus Scanner restarts, and lists any that still apply, such as one with no fixed version yet. The Component Safety Check then runs again on the patched components.
• Afterwards: The installation stays current, and scans, reports and Report Bug work as usual. If anything misbehaves, select Revert in Preferences > Options > Advanced. Revert returns to the components this version shipped with.

Node Runtime

Updates the Node.js runtime the scanner runs on to a newer long-term support (LTS) release, once it has passed the waiting period and safety checks. If the update includes a release that nodejs.org marks as a security release, the screen and its notice say so. It shows the same antivirus note as Dependency Patching.

• Waiting Period: As for Dependency Patching, applied to runtime releases.
• Release: Shows the version in use and the version that will be installed, or explains why nothing will be, including when a held-back release becomes available.
• Update Runtime: Downloads the release from nodejs.org over HTTPS, checks it against its published checksum and the Node.js project's code signature, keeps it in a separate folder, and confirms the scanner still loads on it. The signature is checked again every time the scanner starts, and the bundled runtime is used if it fails. If the scanner fails to start twice on a new runtime, the original is restored automatically.

Component Safety Check

Every time Octopus Scanner starts, and once a day while it stays open, the components it runs on are checked against osv.dev, a public database of malicious packages and security advisories. The check covers the components that ship with the app, any installed through Dependency Patching, and any downloaded engine. Only component names and versions are sent.

• Malicious Component Found: Appears if a component in use has been reported as malicious, even while you are using the app.
  • The scanner stops and won't start until the problem is fixed.
  • Each component is listed with where it came from and a View report button labelled with its advisory ID, which opens the advisory on osv.dev.
  • Remove Engine Update returns to the engine that ships with the app, and Revert and Restart removes updated dependencies. When the component ships with your version, a fixed release is needed, and a button opens the page where you can download one.
  • Check Again runs the check once more, and Quit closes the app.
• Security Advisory for a Component: Appears once at startup when a component has a high or critical security advisory.
  • This isn't malware, and you can keep scanning.
  • Continue carries on, and Review Dependency Patching opens Dependency Patching, where a fixed version may be available.
  • For axe-core, the fix comes through the accessibility engine update instead: Review Engine Update opens Engine Update Available when a newer engine has been released.
  • An advisory you have seen isn't shown again.
• Limits: The check only knows about packages that have already been reported, and it doesn't replace antivirus software. If osv.dev can't be reached, components aren't checked and the scanner starts as normal.

Preferences: Data, Release Notes, Support and Legal

• Data: Export Activity Logs saves the System Activity log to a text file, named Octopus Logs by default.
  • Application Data opens the folder where reports and other app data are kept.
  • Reset Data clears settings, including the server port and Open At Login, logs, accepted terms and everything the scanning interface has saved, including saved configurations, remembered choices and Local LLM Review settings, and returns the app to its startup screens. It also removes updated components, including an updated Node.js runtime, the npm download cache and downloaded app updates, unless an app update is downloading or ready to install. Reports are kept. It also stops a scan that is running.
  • Uninstall Guide explains how to remove Octopus Scanner and its data.
  • For where files are kept, see where files are kept in the Troubleshooting Guide.
• Release Notes: Latest Release opens this website's Release Notes page.
• Support: Links to The Complete User Guide, the Troubleshooting Guide, Common Questions, the Security Warnings Guide and Data Handling and Privacy, which opens this website's Data, Privacy & Security page. Copy Prompt copies a ready-made question about Octopus Scanner to paste into an AI assistant.
• Legal: Terms & Conditions, Third-Party Licences and Installed Licences, which opens the folder of components installed right now, including any you have updated, each with its own licence file. On Windows, Third-Party Licences opens the licences file installed with the app, so it matches your version and works offline, and opens this website if that file is missing.

Update notices

When an update is available and its notifications are turned on, a notice appears at startup. Each notice lists what is available and opens the matching screen, so you can review it before anything is installed. Nothing is downloaded or installed without your approval. If a check finishes after startup has moved on, its notice waits for the next point in startup and never appears over the main window. Installing an older version than the one you were using is reported as a downgrade rather than an update. A new version of Octopus Scanner is only offered once its signed download for your system can be verified. While you are installing one, engine and component notices wait until the new version opens, so you are only offered versions newer than the ones it includes. If you skip it, those notices say that the new version may already include newer versions.

Engine Update Available Keeps your scans current with the latest accessibility checks. Engine updates are offered as soon as they are released and verified before they are installed. Your antivirus or security software may scan or briefly block new components while they install. This is expected; let the scan finish, then try again if needed. SkipUpdate

Text description: Engine Update Available screen, with Skip and Update buttons

Example of the Engine Update Available screen: a shield icon, the heading Engine Update Available, the text Keeps your scans current with the latest accessibility checks. Engine updates are offered as soon as they are released and verified before they are installed. An information note says your antivirus or security software may scan or briefly block new components while they install. This is expected; let the scan finish, then try again if needed. Skip and Update buttons.

• App updates: Selecting Download Update downloads the new version of Octopus Scanner from this website, with a progress bar and a Cancel button.
  • Before anything is opened, the app checks that the release information is signed by the developer and that the file's size and SHA-256 checksum match.
  • On Windows it then opens the new Setup file and closes so Setup can replace it. If a scan or component update is running, it stays open and asks you to close it when that finishes. On macOS it opens the .dmg. While the app is still open, the screen offers Quit Octopus Scanner and Not Now.
  • If the download fails or can't be verified, the file is deleted and you can choose Skip, Product Page, which opens the download page, or Try Again. If the release information can't be checked at all, on macOS the Download page opens instead. On Windows, Couldn't check for the update appears instead, with Try Again and Continue, which keeps using the current version.
  • Update files are kept in the application's data folder and removed after seven days.
• Review Licences: Before anything is downloaded, selecting Update on Engine Update Available, Update Runtime on Node Runtime, or Manual Patch on Dependency Patching opens Review Licences.
  • It lists each component you are about to install with its licence and a link to view it, plus a link to the Third-Party Licences for the components shipped with Octopus Scanner.
  • Updated components come with their own licences, so tick I have reviewed and accept the licences of these components to enable Accept and Install, or select Cancel to go back without installing anything.
  • On Dependency Patching, the screen also explains that libraries the selected components depend on may be updated too, under their own licences, and that a full list is saved in the update folder after installing.
• Engine updates: Selecting Update on Engine Update Available opens Updating Engine, with a progress bar, a percentage and a line naming each step: downloading axe-core, checking it against its checksum, confirming the release with the npm registry, and installing it.
  • Skip on Engine Update Available carries on without updating instead.
  • Engine Updated then confirms the previous and new versions, and Continue carries on with startup.
  • If anything fails, you return to the update screen with the reason shown, and Try Again starts again.

For downloading new releases of Octopus Scanner itself, see the Install Guide.

15. Related guides

• Your First Scan walks you through a scan from start to finish.
• Report Anatomy, top of the page explains each part of the report.
• The Troubleshooting Guide, top of the page helps when something doesn't work as expected.