Nextcloud Security Scan Trigger

I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.)

on

Which general topic do you have

For the past few months, I have been attempting to use the Nextcloud security scan (https://scan.nextcloud.com) to evaluate my self-hosted Nextcloud instance. Unfortunately, the scan fails to initiate, indicating that the last scan occurred in August 2025. Despite multiple attempts to re-trigger the process, it does not execute. Could you please advise if there is a specific procedure required to initiate a new scan?

Hello Jwtoler

This is usually on the scan.nextcloud.com service side rather than something wrong with your instance config, that scanner has had periodic backlog/queue issues reported before where re-scans just silently don’t trigger for accounts that were previously scanned.

A few things worth trying:

Double-check your instance is actually reachable from outside (not behind a firewall/VPN-only setup that changed since your last successful scan in August 2025), since the scanner needs to reach your instance externally to redo the check, and a silent failure to connect can look identical to “scan just isn’t running.”
Try triggering it from a different browser/logged out session, sometimes cached scan results tied to your account get stuck rather than actually re-querying.
Check if your instance’s .well-known endpoints and security headers are still correctly configured, since a fully broken security response can sometimes cause the scanner to fail silently instead of showing a proper error.
If none of that helps, this is worth reporting directly as a bug on the nextcloud/security-scan GitHub repo rather than the general help forum, since the scanning service itself is a separate tool from Nextcloud server, and its maintainers are the ones who’d actually see stuck scan queues on their end.

Regards,
Herrick P

DevOps Engineer @accuweb.cloud

I just tried it on my own instance. I nearly forgot about it, between re-triggering and when I checked was about 3h, but it still works (before there was also a cached result).