Frequently Asked Questions

Do your scans meet the requirements for PCI compliance?

Yes. Our external vulnerability scans are Approved Scanning Vendor (ASV) certified and approved. Included with every passing scan is a certified PCI DSS Attestation of Scan Compliance report.

How long do scans generally take?

Scan duration depends on the responsiveness of your server. Some scans finish in close to an hour, while others take over four hours.

Which IP Addresses Should I Scan?

Read our article on this here.

What IP address do your scanners use?

Our scanners are located on the 38.123.140.0/25 network. If your firewall or WAF blocks unrecognized traffic, whitelist this range so the scan can reach your server.

How often should I have my site scanned?

For most customers, we recommend that you schedule scans monthly.

Will a PCI scan cause my server to go down?

Our scans are designed to be low-impact and non-intrusive.

How do I get my scan results?

You will be notified by email when your scan completes. Log in to your ServerScan account, go to scan portal, then click "Compliance Reports".

How do I request an exception for a false positive?

Log in to your account, go to scan portal, then click "Exceptions" under "Scan Options". Create a scan exception request for each unique vulnerability rated Medium or higher that you believe is a false positive. Low findings don't affect your results, so they don't need one. We usually review requests within one business day. Once they're approved, you can regenerate your reports to show a passing result.

Can you help me fix what my scan finds?

We find the problems, but we don't make changes to your servers. Your developer or hosting company can fix most findings. If you don't have a developer, our remediation partner LN Webworks can help. See our remediation partner page for what they do and how to reach them.

How do I complete my Self-Assessment Questionnaire (SAQ)?

In the My Account section of ServerScan after you log in, all of the SAQ forms are available for download.

Which Self-Assessment Questionnaire should I complete?

This depends on how you receive, transmit, and/or store credit card information. See our SAQ Selection Guidance page.

Can I adjust the schedule of my scans?

Yes. Log in to your account, go to scan portal, click "Scan Schedules" under "Manage Scans".

What other types of scans does PCI DSS require?

See: Scanning Requirements Explained.

How does your money-back guarantee work?

If you are unable to obtain a passing PCI scan with the resources we provide, and our support team cannot get you there, we will refund your full purchase price, as long as you ask in writing within 30 days of purchase. Our refund policy has the details.