Scheduled scans
Craft has no scheduler of its own, so Microscope offers two ways to start a due scan. Pick one under Microscope → Settings.
Cron (recommended)
Run this hourly. It checks whether a scan is due and starts one only when it is, so the frequency of the cron job is unrelated to the frequency of your scans:
0 * * * * cd /path/to/site && php craft microscope/scan/scheduled
The settings screen prints this line with your site’s actual path filled in, ready to paste.
Control panel requests
For hosting without usable cron. Microscope checks whether a scan is due after the response has been sent, so nobody waits for it, and pushes the scan onto Craft’s queue behind a lock so several concurrent requests can’t start several scans.
The trade-off is honest: it only works while somebody is using the control panel. On a site nobody logs into for a fortnight, the weekly scan happens when somebody next logs in. It needs no server access at all, which is the point.
Frequency
Daily, weekly or monthly, at an hour you choose in the system timezone.
- Weekly also takes a day of the week.
- Monthly also takes a day of the month, capped at the 28th — “the 31st” would silently skip February and three other months a year.
Notifications
Switch on Email scan results and add recipients, one per line. Environment variables are supported, so $SCAN_REPORT_EMAIL is a perfectly good value and the address itself stays out of project config.
There are three options for when to send:
| Setting | Sends |
|---|---|
| Only when something new appears (default) | When a finding is new since the previous scan, or has got worse. |
| Whenever there are any problems | Any scan with at least one non-passing finding. |
| After every scan | Always, including clean ones. |
The default is deliberate: a report that arrives unchanged every week stops being read, and once it stops being read the one week it did change goes unnoticed too. Staying quiet while nothing has changed is what keeps the email worth opening.
Attach the PDF report adds the rendered file to the email, when dompdf is available.
Testing it
To send the configured notification without waiting for the schedule:
php craft microscope/scan/run --notify
To check the schedule logic itself, run the scheduled command by hand — it will tell you whether a scan was due and start one only if it was:
php craft microscope/scan/scheduled
The next due time is also available in Twig as craft.microscope.nextScheduledScan().
Suppressing scans during a deploy
Scans::EVENT_BEFORE_SCAN is cancellable, which is the hook for keeping scheduled scans out of a deploy window. See Extending.