# Domain Scans



OptinStack discovers trackers by loading pages on your registered hostname and recording scripts, storage, and related resources. Register the public hostname visitors actually use. If your site is served through a reverse proxy, that usually means the proxy hostname, not the private origin behind it.

This page summarizes product behavior. The binding disclosure is published at [Domain scan disclosure](https://optinstack.com/legal/domain-scans) on our marketing site.

## Page limits by plan [#page-limits-by-plan]

| Tier       | Pages per scan |
| ---------- | -------------- |
| Free       | 50             |
| Pro        | 100            |
| Business   | 350            |
| Enterprise | 1,000          |

These limits define how many discovered pages are included in each scan.

<Callout type="info">
  Webflow, Framer, and custom hostnames use the same Free or paid assignment rules. Platform choice does not unlock paid features.
  Free scans are capped at 50 pages per run with a 24-hour cooldown by default. Free can activate on each eligible verified custom hostname or registered development hostname (unlimited Free hostnames by default).
</Callout>

## Which hostname should I register? [#which-hostname-should-i-register]

Register the **exact** hostname visitors see in the browser address bar (after redirects):

* Use `example.com` **or** `www.example.com` when that is the host that serves traffic—not both unless each is a separate production property you license.
* Prefer the host that remains in the address bar after HTTPS redirects (if everyone lands on `www.`, register `www.`).
* Use the custom production hostname when Webflow, Framer, or another platform serves your site on a connected domain.
* Use the reverse-proxy hostname when traffic reaches your site through a proxy or edge layer.
* Do not register a private origin hostname unless visitors also load the site directly from that hostname.

### Business rules [#business-rules]

| Rule                 | Guidance                                                                                                                            |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Unit of coverage     | One hostname = one Free assignment (unlimited Free hostnames by default), one paid Pro/Business subscription, or Workspace coverage |
| Runtime identity     | Banner config, consent, and assignment apply only to hostnames registered and entitled for the project                              |
| www vs apex          | Pick the host that serves visitors; redirect the other. They are not interchangeable unless both are registered and licensed        |
| Second public domain | Separate registration and license                                                                                                   |
| Private origin       | Unsupported                                                                                                                         |

OptinStack stores platform-detected hostnames and user-confirmed hostnames separately. Staging hostnames stay available for testing. Production scans, billing, consent records, and published runtime configuration use the configured public production hostname.

## Reverse proxies and custom hostnames [#reverse-proxies-and-custom-hostnames]

Reverse proxies are supported when the public hostname is reachable over HTTPS and returns the pages visitors see. The scanner follows the public site, not your private origin infrastructure. There is no separate “origin hostname” mapping: the public host is the commercial and runtime identity.

If `site.com` reverse proxies to `project.webflow.io`, register `site.com` as the production hostname. Keep the platform hostname as a staging or detected hostname for preview testing. Billing applies to the public production hostname, because that is the property where visitors use OptinStack.

If you serve two different public domains, register and license each one. OptinStack does not treat cross-domain reverse-proxy pairs as a single licensed site.

## Framer and Webflow staging vs production [#framer-and-webflow-staging-vs-production]

Embedded platforms often expose a staging hostname before a custom production domain exists. OptinStack treats these differently:

* **Development hostname**: a Webflow or Framer hostname used before the production domain is ready. It follows the same Free or paid assignment rules as every other hostname.
* **Free hostname**: a production-capable Free assignment on an eligible registered hostname (unlimited Free hostnames by default), with a 50-page scan cap and 24-hour cooldown by default.
* **Platform production hostname**: detected from the platform and confirmable as your production hostname.
* **Custom production hostname**: entered by you when visitors use a public domain that differs from the platform hostname, such as a reverse-proxy or connected domain.

If you start setup with only a staging hostname, you can finish onboarding and test the banner. When a production hostname is added later, confirm it in OptinStack before using it for production scans, billing, and runtime configuration.

## Scanner access and WAFs [#scanner-access-and-wafs]

The scanner needs to load your public pages over HTTPS. Results may be incomplete or fail when a firewall, bot protection rule, authentication wall, geo rule, or rate limit blocks automated browsing.

If a scan fails on a reachable public site, allow **OptinStack-Bot** through your WAF or bot protection (see [OptinStack-Bot](https://optinstack.com/bot) for user agent and Web Bot Auth details), then run the scan again. OptinStack does not scan logged-in areas or private origins that are not publicly accessible.

## How URLs are chosen [#how-urls-are-chosen]

1. **Discover**: Read `https://{hostname}/sitemap.xml` when available (including child sitemaps when the root file is a sitemap index); otherwise crawl HTTPS links on `/`.
2. **Normalize**: Dedupe URLs (same path variants, bare root vs trailing slash).
3. **Order**: Pin homepage first when present; then common compliance paths (privacy, cookie policy, terms, contact, and similar when present); then stable locale-aware alphabetical order for the rest.
4. **Select**: Take the first *N* URLs for your plan (`N` = scan limit).

Higher plans scan a longer prefix of the same ordered list. Free’s first 50 pages are always the first 50 pages a higher plan would scan for the same discovery result, when at least 50 URLs exist.

## Consistency [#consistency]

For a **fixed** sitemap or homepage link set:

* Repeated scans on the same plan should target the **same URLs**.
* Activating a higher plan adds pages at the end of that ordered list; it does not reshuffle Free’s selection.

## When counts can still change [#when-counts-can-still-change]

Even with the same URLs, tracker totals may vary because of:

* Site or tag-manager changes between scans
* Conditional loading (consent state, geography, experiments)
* Timeouts or blocked third-party resources during automated loads
* Pages not in the discovered set (login-only areas, unscanned URLs beyond your plan cap)

## Large sitemaps [#large-sitemaps]

Sites with thousands of sitemap entries (for example multi-location brands) only scan up to the plan cap. Unscanned URLs are not represented in that run's tracker list.

## Sitemap indexes [#sitemap-indexes]

If the root `sitemap.xml` is a **sitemap index**, we fetch same-host child sitemap documents and merge page URLs (subject to fetch and discovery caps). Flat urlsets list all page URLs in one file.

## What happens if my site has more pages than my plan? [#what-happens-if-my-site-has-more-pages-than-my-plan]

We scan up to your plan limit from the ordered list above. The dashboard may show **scanned** vs **discovered** counts (for example, 50 / 2,775). Trackers on unscanned pages are not included until you upgrade, run again with a higher page limit, or add them manually.

## Will two scans pick the same pages? [#will-two-scans-pick-the-same-pages]

Yes, when the discovered URL set is unchanged and you use the same plan. Changing your sitemap, homepage links, or plan can change which pages are selected.

## Why is my tracker count different between scans? [#why-is-my-tracker-count-different-between-scans]

The same pages can still report different trackers when tags load conditionally, resources time out, or you changed scripts between runs. A different page set also changes totals.

## Related [#related]

* [Domain scan disclosure](https://optinstack.com/legal/domain-scans), customer-facing legal FAQ