Join our Discord
Multipage authentication
Learn how to configure Website Scanner to log in through clicks and values entered across several pages, including a static one-time password.
Use multipage authentication when your login takes more than one page. Typical flows are a username on one page and a password on the next, an extra page where you enter a static OTP, or a combination of both. You describe the login as a sequence of steps spread across pages. Each page lists, in order, the clicks and values Website Scanner performs to authenticate.
Multipage authentication has a new, customizable experience. You now describe the login as steps on pages. The earlier form had fixed fields: Username selector, Next button selector, Password selector, and Submit button selector. New configurations no longer use that form. Configurations saved with the earlier form keep working. See Configurations from the earlier experience.
How login steps work
A multipage configuration has a Start URL, which is the page where the login flow begins. Each page can have a maximum of 8 steps. A configuration can have a maximum of 5 pages. Each step is either a click or a value you enter:
| Action | Purpose | Fields | Example |
|---|---|---|---|
| Click | Click an element on the page, such as a radio button, a Next button, or a Submit button. | CSS selector of the element to click. | Click #next to move from the username page to the password page. |
| Enter value | Type text into a field, such as a username, a password, or a static OTP. | CSS selector of the input field and the Value to type into it. | Enter 123456 into #otp. |
Website Scanner opens the start URL and runs the steps of Page 1 in order. It then runs the steps of each following page on the page that loads. When the last step is done, the scan continues on the page Website Scanner reached.
If your login flow includes a one-time password (OTP), the OTP must be static. A static OTP stays the same on every login. Dynamic OTPs that change on every login are not supported. A static OTP can be of any length and can contain letters and numbers.
Before you begin
- Find the CSS selector of every field and button in the flow, on every page. See Find CSS selectors.
- Use a test account, not a production account.
- If your login requires a one-time password (OTP), confirm that it is the same on every login.
Configure multipage authentication
To configure multipage authentication, follow these steps:
Navigate to the Website Scanner dashboard and click New scan.
Select a scan mode tab: Manual mode, Sitemap, or Crawler.
Add pages to scan based on your selected mode:
- Manual mode: Enter a URL in the Enter page URL field and click Add page. Repeat for each URL, or use the dropdown to upload a CSV.
- Sitemap: Enter a domain URL or sitemap.xml URL in the Enter domain URL or sitemap.xml URL field and click Add sitemap.
- Crawler: Enter a starting URL in the Enter page URL field and click Start Crawl. The crawler discovers linked pages automatically.
Click the settings (gear icon) to open Advanced scan settings.
In the General settings tab, click Add next to Test pages behind login.
Click New configuration.
Enter a configuration name and select Multipage authentication from the dropdown. The Login steps section appears with Page 1.
Enter the Start URL. This is the page where the login begins.
Add a step for each action on the first page, in the order you perform it:
- For a field where you enter a value, such as a username or password, select Enter value in Action. Enter the CSS selector of the field and the Value to type into it.
- For a button or any other element you click, select Click in Action and enter its CSS selector.
Click Add step to add the next step. A page holds up to 8 steps, after which Add step is unavailable. Click the X next to a step to remove it.
Click Add page to configure the page that loads after the previous step. Add its steps in the same way. A configuration can have a maximum of 5 pages. Click the delete (trash) icon on a page to remove it.
Choose a wait time in Add delay if the login page is heavy or slow to load.
Otherwise, keep the default of 0 seconds. You can add up to 30 seconds.
Click Verify login configuration. Website Scanner opens the start URL and runs your steps page by page. This step is optional, but it catches a wrong selector or value now instead of in a failed scan later. Verification takes about a minute per page.
Check the Snapshot after verification against the page you expect after signing in. If the result names an error, see Troubleshoot authentication errors.
Click Save & confirm.
Your multipage authentication is now configured. Website Scanner runs the same steps on every scan that uses this configuration.
Example: username, password, and a static OTP
The first page has the username and password fields. The next page has a static OTP field. The login steps for this flow are:
| Page | Step | Action | CSS selector | Value |
|---|---|---|---|---|
| Page 1 | 1 | Enter value | #username |
Your test username |
| Page 1 | 2 | Enter value | #password |
Your test password |
| Page 1 | 3 | Click | #next-btn |
None |
| Page 2 | 1 | Enter value | #otp |
123456 |
| Page 2 | 2 | Click | #submit-btn |
None |
After you save, the Confirm login configuration dialog lists the flow page by page.
A login with the username and password on separate pages is also two pages. Page 1 has an Enter value step for the username and a Click step for the next button. Page 2 has an Enter value step for the password and a Click step for the submit button.
Reuse a saved configuration
Saved multipage configurations appear under Your saved configurations with the start URL and the number of pages and steps. Select one to review its steps and confirm it for the scan.
You cannot edit a saved configuration. To change a flow, create a new configuration.
Configurations from the earlier experience
Your configurations saved before the new experience still work and stay in the list. They show the username instead of a page count, and their details list the fields of the earlier form: Login page URL, Username, Password, and the username, next button, password, and submit button selectors.
To move such a login to the new experience, create a new configuration with two pages. See Example: username, password, and a static OTP.
Next steps
- Troubleshoot authentication errors if the verification reports an error or a scan cannot sign in.
- Configure form authentication if your login is a single page with username and password fields.
- Configure basic authentication if your site uses HTTP Basic auth popups.
We're sorry to hear that. Please share your feedback so we can do better
Contact our Support team for immediate help while we work on improving our docs.
We're continuously improving our docs. We'd love to know what you liked
We're sorry to hear that. Please share your feedback so we can do better
Contact our Support team for immediate help while we work on improving our docs.
We're continuously improving our docs. We'd love to know what you liked
Thank you for your valuable feedback!