# What does it mean when your firewall blocks a Lockpick scan?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

When your edge firewall turns a Deep scan away partway through, the report credits it as a working control. Here is what that means for your results.

When your edge firewall notices a Deep scan looking for sensitive files and starts turning it away, the report credits that as a working control. The tests after the block did not run.

## What does this check look at?

It looks at whether your edge firewall noticed the scan looking for sensitive files and started turning it away. It only appears when the block came after most of the site was read. A block at the start is reported as a block, not a credit.

Requests are spaced out, and a scan stops early if your site slows down, fails or refuses. The report keeps everything read before the block.

Only a Deep scan runs it, after you prove you own the site. It applies only when an edge challenge stopped a scan after most of the site was read.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Pass | Your edge turned the scan away the way it would turn away an attacker tool. | Nothing to fix. Allow Lockpick through if you want every test to finish. |

The tests after the block were not run, so the report cannot say what they would have found. A credit does not show what the skipped tests would have found.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

No OWASP, CWE or ASVS reference fits this check closely enough to state, so the report and this page leave it unmapped.

## Fix it with your AI

There is nothing to fix. If you want full coverage, let signed Lockpick requests through your firewall.

:::fix-prompt any
My edge firewall blocked a Lockpick Deep scan partway through, which is good. I want the next scan to finish every test. In my firewall or bot protection settings, add a rule that skips bot checks and rate limits only when the Signature-Agent request header contains bots.lockpick.app, and place it above rules that challenge or deny. Do not use it to grant access to anything else. Show me the rule before I save it.
:::

Lockpick signs every request, but a header on its own can be copied. That is why the rule only skips bot checks and never opens anything private.

## How to check

Say Atlas, our example app at `atlas.example`, sits behind a bot protection service that challenges the scan after it has read most pages. The report credits the protection and lists which tests were skipped. The [firewall guide](/docs/protect/firewall) shows how to let signed scans through.

Deep scans come with the Deep plan, and [pricing](/pricing) shows what it includes. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Is it bad that my firewall blocked the scan?

No. It means your edge noticed automated probing and acted, which is what you want from it.

### Will allowing Lockpick weaken my protection?

Not if the rule matches only Lockpick’s signed requests. Every other bot still meets the same protection.

## Sources

- [Allow Lockpick through your firewall](https://www.lockpick.app/docs/protect/firewall), Lockpick docs, read on 2026-10-07
- [How we check](https://www.lockpick.app/docs/security/how-we-check), Lockpick docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07