Troubleshooting

Most scan problems fall into three groups: the scanner could not load the site, the request was refused before the scan started, or the scan ran but a result looks wrong. Find your symptom below. Error messages are quoted as the scanner shows them, so you can search this page for the words on your screen.

Why could the site not be loaded?

The scan ran, but the first request for the URL failed, so the report shows "Could not reach" and the domain, with a reason underneath (the CLI prints Could not load <url>: <reason> and exits with code 3). Nothing is scored or stored. The reasons:

Message starts with	Meaning	What to do
"Timed out after 15s"	The site did not answer within 15 seconds	Check the site loads quickly from outside your network; try again when it is less busy
"Domain not found"	DNS has no address for the name	Check the spelling, and that the domain is live and its DNS is set up
"Connection refused"	Nothing is listening on the domain's address	Check the web server is running and accepts connections on port 443 (or 80)
"Connection reset by the server before a response completed."	The server or something in front of it cut the connection	Often a firewall or bot protection; see the next question
"The site's TLS certificate has expired."	The HTTPS certificate is out of date	Renew the certificate
"The site's TLS certificate could not be verified."	Self-signed, or the chain is incomplete	Use a certificate from a public authority and serve the full chain
"More than 5 redirects"	The URL redirects more than 5 times, or in a loop	Scan the final URL, and shorten the redirect chain
"The site sent an invalid redirect."	A Location header that is not a valid URL	Fix the redirect on the server
"The site redirected to an address that is not publicly reachable."	A redirect pointed at a private or local address	Scan a URL that stays on public addresses; see Privacy and what gets fetched
"Network error" with a code, or "Could not reach the site (network error)."	Another network failure	Try again; if it persists, the code in brackets says what failed

A page that loads but answers with an error status, such as 404 or 500, is not in this list. That scan runs and the http-status check fails instead.

What if my site blocks the scanner?

Firewalls, bot protection and CDN security rules often block unfamiliar crawlers, which shows up as a timeout, a reset connection, or a scan that loads but fails most checks because every file answers 403. Allow the scanner's user agent, which it sends on every request:

• ToolzAIScan/1.0 (+https://toolz.dev/ai-scan)

The requests come from Toolz.dev's server, not from your computer, so allowing your own IP address does not help. Keep in mind that the scanner is not an AI crawler: if your rules block GPTBot or ClaudeBot but let the scanner through, the scan shows what a normal visitor gets, and the ai-bot-rules check reports only what your robots.txt says.

Why was my URL refused?

These come back before any scan runs, as HTTP 400 from the HTTP endpoint:

Message	Cause
"Enter a URL to scan."	The URL was empty
"That URL is too long."	Over 2000 characters
"That does not look like a valid URL."	It could not be parsed as a URL
"Only http and https URLs can be scanned."	Another scheme
"URLs with embedded credentials cannot be scanned."	The URL has a user:password@ part
"That address is not publicly reachable."	An IP address or host name that points to a private, local or reserved network, including localhost and names ending .local or .internal
"That domain could not be resolved."	DNS returned no address for the host
"Missing url parameter"	An API call with no url
"Invalid JSON body"	A POST whose body is not JSON

To check a site that only runs locally or on a private network, deploy it somewhere public first, even a temporary preview URL, as long as it does not need a login.

What does "Too many scans. Wait a minute and try again." mean?

More than 6 scans came from your IP address within 60 seconds (HTTP 429). Every attempt counts toward that window, including refused ones, so retrying straight away keeps you limited. Wait a full minute. On a shared network (an office, a CI provider's runners) other people's scans from the same address count too. The CLI exits with code 3 on this error.

What does "You have reached your daily scan limit" mean?

The full message is "You have reached your daily scan limit. Sign in or upgrade for more." Your account type's daily allowance is used up. The command line, the MCP server and the HTTP endpoint get the same message, with HTTP status 429. Sign in to a free account for a larger allowance, upgrade to Toolz Pro for unlimited scans, or come back tomorrow. See Public and private scans, limits and Pro.

Why can I not run a private scan?

Private scans are a Toolz Pro feature. Without Pro, clicking Private shows what the feature does and a link to the plans instead of switching. Through the API, a private request without a Pro sign-in gets HTTP 403, code: "PRO_REQUIRED" and "Private scans are part of Toolz Pro. Run it as a public scan, or upgrade at toolz.dev/pricing."

If you have Pro and still see this, sign out and in again, then retry. The server asks the backend for your current plan with your sign-in token, and refuses when it cannot confirm Pro, for example when the token has expired or the backend did not answer within 3 seconds.

Why does the scan say "The scan could not be completed"?

"The scan could not be completed. The site may be unreachable." (HTTP 502) means the scan failed on the server in a way the scanner did not expect, rather than with one of the messages above. Try again in a minute. If it keeps happening for one site, contact us with the URL.

On the scanner page, "Could not reach the scanner. Check your connection and try again." means your browser could not reach Toolz.dev at all.

Why is my score different from last time?

Usually one of these:

• A different filter. Content Site, API · Application and All Checks run different checks, and the same site can score a B with one and a D with another. See Scores, grades and scan filters. The CLI and the MCP server always run all checks.
• Time to first byte. It is measured from Toolz.dev's server on each scan, so a slow moment can fail the ttfb check (under 800 ms passes) on one run and pass it on the next.
• A slow discovery file. Most root files and discovery paths get 2.5 seconds. A file that answers slower counts as missing on that run.
• A cached old version. A CDN or hosting cache can still serve the file you replaced.

Why does a check fail when the file is there?

Check the detail line under the issue, which says what the scanner saw. Common causes: the file answered with a non-2xx status (for example a redirect to a login page that then returns 403), it took longer than 2.5 seconds, llms.txt has no # heading line, a JSON-LD block does not parse as JSON, or the tag is added by JavaScript after the page loads, which the scanner does not run. What the scan checks has the exact pass condition for every check.

Why is a check marked as not applicable?

It could not be evaluated, so it was left out of the score rather than failed: the DNS lookup for DNS-AID could not complete, the Markdown re-request got no answer, or the check hit an error ("Check could not be evaluated"). It does not lower your score.

Still stuck? Contact us with the URL you scanned, the report link if there is one, and the exact message.