Weekly re-scan & deploy webhook

Loomaly can scan your site again without anyone asking for a full check. Three things start a scan on their own, and all three need the site to be verified:

Weekly re-scanCopy Anchor Link

Weekly re-scan is managed under /account for the site. The switch is Re-scan every week and email me the report. You usually don't have to turn it on yourself: it switches on by itself when the site is verified. status and report show when the next scan is due.

What it doesCopy Anchor Link

• A full scan every week. Each re-scan is the same scan as check with target: site: Loomaly reads your sitemap and crawls for new pages, runs the rule checks and AI judgment on every page, tests the representative pages for speed, then runs the page judgments and looks for internal links. Issues that are gone are closed as fixed; new ones are added. See How a scan works.
• When it runs. Loomaly starts weekly re-scans at 03:00 UTC. A site comes due a week after the switch was turned on, then every seven days. That morning's run starts every scan due before the next 03:00, so a due time a few minutes past 03:00 does not wait until the next day. If a scan of the site is already running, that week's re-scan is skipped. Weekly re-scans are part of a paid plan.
• A report every Monday. The project owner gets an email summarising what's new and what got fixed since last week, the health score, and what to fix first. See Weekly report email. If a scan finds the site newly broken in search (many pages turned noindex or erroring, say), an urgent alert goes out right away instead of waiting for Monday. You can also pull the same summary with report.

Turning it offCopy Anchor Link

• Switching it off under /account stops both the weekly re-scan and the email.
• Stop emails about this site in the email turns off only the emails (the weekly report and urgent alerts). The weekly re-scan keeps running. To get the emails back, switch the weekly re-scan off and on again.

What it usesCopy Anchor Link

A weekly re-scan counts the same as a full-site check: finding your pages and the checks on every page never count, and each representative page tested uses one of your plan's monthly pages. When the month's pages are used up, the re-scan still checks every page; it just tests no pages in depth. See Plans & pages.

Verify your siteCopy Anchor Link

You don't need to verify a site to scan it. Verification proves you control the site, and unlocks what runs without you:

Until the site is verified, /account says you need to prove you own the domain before the weekly re-scan turns on by itself. There are three ways.

Connect Google Search ConsoleCopy Anchor Link

Ask your assistant (google with action: connect) or open Google settings under /account. Sign in with a Google account that is an owner or full user of a Search Console property for the domain (a Domain property, or a URL-prefix property for the site root). Connecting counts as verification, and it brings your search data into Loomaly too. See Google Search Console.

A DNS record or a meta tagCopy Anchor Link

Under /account, open the other verification methods, pick DNS or meta tag, and generate a token.

rp-verify=YOUR_TOKEN

Copy the exact value shown under /account; it contains your token. The token stays the same if you switch methods.

If the check fails, wait and try again. Loomaly also re-checks pending verifications every hour, so you can add the record and leave. Once a site is verified, Loomaly doesn't check it again.

When the site is verifiedCopy Anchor Link

The weekly re-scan and the weekly report switch on by themselves, and the first re-scan runs a week later. /account now shows the switch, and the deploy webhook section appears. If you don't want the weekly re-scan, switch it off.

Deploy webhookCopy Anchor Link

The deploy webhook lets your CI/CD tell Loomaly "we just deployed". Each call starts a full scan of the site, the same as check with target: site.

Get the URLCopy Anchor Link

Under /account, find Deploy webhook (it appears once the site is verified) and generate a webhook URL. It looks like this:

https://loomaly.com/api/hooks/deploy/YOUR_TOKEN

The token in the URL is the only credential. There's no header or signature to add. Treat the URL like a password: keep it in your CI's secrets, not in your repository. If it leaks, rotate the token under /account. The old URL stops working immediately.

Call itCopy Anchor Link

• Method: POST or GET. Both do the same thing.
• Headers: none required.
• Body: not needed. Anything you send is ignored.

Call it after the deploy is live. The scan fetches your public site, so calling it while the old version is still being served scans the old version.

Calls are debounced: while a scan is running, or if one started less than 10 minutes ago, the call is accepted but no new scan starts (the running scan will see your latest deploy anyway). Call it from production deploys only, not from preview or branch deploys.

curl -fsS -X POST "https://loomaly.com/api/hooks/deploy/YOUR_TOKEN"

ResponsesCopy Anchor Link

A successful call returns 200:

{ "ok": true, "enqueued": 1, "siteId": "..." }

If the call was debounced, it still returns 200, with "enqueued": 0 and "skipped": "scan in progress" or "skipped": "scanned recently".

What it usesCopy Anchor Link

A webhook scan is a full scan and counts the same as a full-site check: only the representative pages tested use your plan's pages. See How a scan works and Plans & pages.

Pull request checksCopy Anchor Link

On the Pro and Agency plans, GitHub integration is configured under /account. After you install the Loomaly GitHub App and choose a repository, a pull request comment lists issues the changed pages would add and issues they would fix, compared with the same paths on the live site. Loomaly waits for the preview deployment, then reads those pages there. It updates the same comment when you push again.

The comment is posted as loomaly[bot]. It does not change the repository and it does not block merging. Each page uses one fix check, the same allowance as a re-check, and does not use the monthly page allowance. After the pull request is merged and the production deployment succeeds, Loomaly re-checks those live pages.

The same comparison is available to an assistant via check with a preview URL. A noindex on the preview is normal. A password-protected preview (HTTP 401) is reported as such.

Sitemap checkCopy Anchor Link

Once an hour, Loomaly looks at sitemap.xml (or sitemap_index.xml) on each verified site that has the weekly re-scan on. If the sitemap's Last-Modified header (or, when there isn't one, the first lastmod date inside the file) has changed since the last check, Loomaly starts a full scan, just like the deploy webhook.

The first time Loomaly sees a sitemap, it only records the date. Scans start from the next change on. There's no separate switch: switching the weekly re-scan off stops this check too. It counts the same as any other full scan.