What does it mean when your firewall blocks a Lockpick scan?

When your edge firewall notices a Deep scan looking for sensitive files and starts turning it away, the report credits that as a working control. The tests after the block did not run.

What does this check look at?

It looks at whether your edge firewall noticed the scan looking for sensitive files and started turning it away. It only appears when the block came after most of the site was read. A block at the start is reported as a block, not a credit.

Requests are spaced out, and a scan stops early if your site slows down, fails or refuses. The report keeps everything read before the block.

Only a Deep scan runs it, after you prove you own the site. It applies only when an edge challenge stopped a scan after most of the site was read.

What does a result mean?

The tests after the block were not run, so the report cannot say what they would have found. A credit does not show what the skipped tests would have found.

How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.

Fix it with your AI

There is nothing to fix. If you want full coverage, let signed Lockpick requests through your firewall.

My edge firewall blocked a Lockpick Deep scan partway through, which is good. I want the next scan to finish every test. In my firewall or bot protection settings, add a rule that skips bot checks and rate limits only when the Signature-Agent request header contains bots.lockpick.app, and place it above rules that challenge or deny. Do not use it to grant access to anything else. Show me the rule before I save it.

Lockpick signs every request, but a header on its own can be copied. That is why the rule only skips bot checks and never opens anything private.

How to check

Say Atlas, our example app at atlas.example, sits behind a bot protection service that challenges the scan after it has read most pages. The report credits the protection and lists which tests were skipped. The firewall guide shows how to let signed scans through.

Deep scans come with the Deep plan, and pricing shows what it includes. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.