Questions
How do I compare two scans of the same site?
Comparing two scans of the same site turns a list of findings into a list of changes: which findings appeared since the baseline, which were resolved, and which are unchanged. That is a more actionable output than either scan on its own, because a finding that appeared between two dates has a cause you can name — a deployment, a configuration change, a dependency update — and a finding that has been there for a year usually does not.
What a comparison reports
Findings that appeared: present in the newer scan and absent from the baseline. These are the ones with a recent cause.
Findings that were resolved: present in the baseline and absent now, which is how you confirm a fix actually took effect.
Findings that persist unchanged, which is the backlog rather than the news.
Movement per category, so a degradation concentrated in one area is visible as such.
Metric deltas, where a measurement moved rather than a finding appearing or disappearing.
Why it beats reading two reports side by side
A report on a real site has many findings, and most of them are the same in both. Reading two lists means re-reading the unchanged ones twice.
The changes are what carries information, and they are a small fraction of the total.
A comparison also catches a finding that disappeared, which is easy to miss when scanning a list for problems.
And it attaches a time window to each change, which is what makes a cause findable.
What makes a comparison misleading
Different coverage between the two runs: a finding that disappeared may simply be on a page the second crawl did not reach.
A partial run, where one of the two scans did not complete — which has to be visible in the comparison rather than silently treated as a clean result.
A site that changed structurally between the scans, where the two are describing different sets of pages.
Comparing across a redesign, where almost everything differs and the output is noise.
Which is why the coverage of both runs is worth reading before the delta.
When to take a baseline
Before a deployment you expect to be risky — a framework upgrade, a platform migration, a CDN change.
Before and after a fix, which is how you confirm the fix rather than assume it.
On a schedule, so a slow degradation has something to be measured against.
Before handing a site to someone else, which gives both parties a record of the state at handover.
The baseline only has to exist; it does not have to be clean.
What a comparison cannot tell you
Why a finding appeared. It gives you the window, and the cause is in your deployment history.
Whether a resolved finding was fixed or merely not observed — which is what the coverage figures distinguish.
Anything about the period between the two scans, since neither observed it.
Whether a persistent finding has become more or less urgent, which is a judgement rather than a measurement.
Reading the comparison in the right order
Start with whether both runs completed. A comparison involving a partial run is flagged as such, and its disappeared findings are the least trustworthy part of it.
Then read the coverage of each run. Similar coverage means the delta describes the site; very different coverage means it partly describes the crawl.
Then the appeared findings, sorted by impact, because they are the ones with a recent and findable cause.
Then the resolved findings, which confirm or fail to confirm the fixes you believe you shipped.
Leave the unchanged findings for last. They are the backlog, and a comparison is the wrong tool for prioritising a backlog — the findings list and its weights are the right one.
Metric deltas deserve the same caution as any single measurement: a small movement in a timing figure between two runs is within ordinary variation and is not, on its own, a change.
Frequently asked questions
- Does comparing re-run the checks?
- No. It compares two reports the engine already produced. The numbers on each side are the ones that scan computed, not recomputed for the comparison.
- A finding disappeared. Is it fixed?
- Check the coverage of both runs first. A finding on a page the second crawl did not reach disappears from the report without anything changing on the site.
- How far apart should the two scans be?
- Close enough that the cause is findable in your deployment history. Around a release is ideal; across a redesign the output is mostly noise.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website