https://scan.nextcloud.com/ seems not doing the scan refresh
since several days still saying : Scanned at 2026-01-18 07:00:52
my instance : nxt.pra.rip
i just would like to check if all is ok but still stay as stuck at my last check in january …
thank you for your help
You need to manually trigger a rescan, it doesn’t do that automatically 
yep i clicked on the button and got a popup saying a new scan will be done in 5 minutes but i have the same Scanned at 2026-01-18 07:00:52 
info done this every time that why i opening this ouin ouin
I have just done a security scan and it worked for me - Scanned at 2026-07-01 13:42:26
Thanks for confirming!
Maybe something changed on your side @pra that prevents a connection from the scanner?
upgrade in latest nextcloud lol long time ago
but everytime i have this url : Nextcloud Security Scan Results
what do you have when you write nxt.pra.rip ?
✗ curl -I https://yourdomain/status.php
HTTP/2 301
server: nginx
date: Wed, 01 Jul 2026 15:39:31 GMT
content-type: text/html
content-length: 162
location: https://google.fr
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Well 
normal no file status.php thus redirect to google <= oh oh sorry
found status.php .
need to change my rule - thank you
but you can try : curl -I https://nxt.pra.rip/index.html
Yea, but I am pretty sure the status.php is required for the security scanner, so that explains why you don’t get new checks
done
hope you don t change the ip of your scan : )
running now :
Scanned at 2026-07-01 16:15:53
now looking for blocking except scan : )
Don’t count on it forever 
ah ah ah
for me we can close
thank you for your help @SysKeeper
for info my nginx rule now :
in http node
map $http_user_agent $block_status_php {
default 1;
“scan.nextcloud.com” 0;
~*scan\.nextcloud\.com 0;
}
in vhost or include
if ($block_status_php) {
return 302 https://google.fr;
}
seems working well redirect for all except scan.nextcloud.com
Your NGINX rule works for me:
curl -sA "scan.nextcloud.com" https://nxt.pra.rip/status.php | jq .
{
"installed": true,
"maintenance": false,
"needsDbUpgrade": false,
"version": "34.0.1.2",
"versionstring": "34.0.1",
"edition": "",
"productname": "Nextcloud",
"extendedSupport": false
}
And I see that scan.nextcloud.com indeed uses scan.nextcloud.com as user agent:
[01/Jul/2026:21:58:54 +0200] "GET /status.php HTTP/1.1" 200 3665 "-" "scan.nextcloud.com"
But maybe there’s some kind of rate limit or something on scan.nextcloud.com side.
// EDIT:
Works for me: https://scan.nextcloud.com/results/ab5c2fc6-6bdf-4770-b58c-d13534a38a2b
Thank you @mritzmann , will take a look
probably need to add ip check : (
modification done :
remove last and replace by :
in http node :
geo $remote_addr $is_scan_nextcloud_ip {
default 0;
95.217.53.149 1;
2a01:4f9:2b:29dc::149 1;
}
map $http_user_agent $is_scan_nextcloud_ua {
default 0;
“scan.nextcloud.com” 1;
}
map “$is_scan_nextcloud_ip$is_scan_nextcloud_ua” $allow_status_php {
default 0;
“11” 1;
}
in vhost or include :
location = /status.php {
if ($allow_status_php = 0) {
return 302 https://google.fr;
}
}
should be ok
and need to create a script checking if ip not change for my icinga2 : )
Generally, I don’t see much benefit in security-through-obscurity measures like this, especially if you keep your Nextcloud up to date. Besides, you’ve already made your server’s URL public here anyway, which I don’t see as a problem in itself. However, that’s probably going to generate far more noise in your logs than a publicly accessible status.php ever would. So if the goal of this exercise was to reduce that kind of noise… well.
That being said, if you really want to block it, it doesn’t make much sense to allow scan.nextcloud.com, since anyone who really wants to know your Nextcloud version can query your instance through that service as well. To actually prevent that, I’d say you have to block it permanently and only allow access temporarily when you intend to run a scan yourself. Once the scan is finished, block it again.
and will forget and will lost time and in worst case will repost the same complaint for nothing lol
this rule + icinga is better for me and you : )