The most useful scan is the one you didn’t have to remember to run. SiteCMD can run scans automatically in the background, alert you when something actually changes, and stay quiet otherwise.

This page covers how to set up schedules, what triggers a notification, and what runs when the app window is closed.

How scheduling works

Each project can have one or more scheduled scans. SiteCMD’s scheduler wakes up every minute, checks which schedules are due, and runs them. When the app window is closed, SiteCMD stays in your system tray and the scheduler keeps running. You don’t need the app open.

A schedule is bound to a project and an environment. If you want to scan production daily and staging every hour, that’s two separate schedules.

Setting up a schedule

Open Settings → Scheduled scans.
Click Add schedule.
Pick:
- Project and environment to scan
- Frequency (hourly, daily, weekly)
- Time of day (for daily and weekly)
- Day of week (for weekly)
Click Save.

The next due time appears under the schedule row. You can pause, edit, or delete a schedule from the same page.

What runs

A scheduled scan runs the same engines as a manual one. If a source folder is linked to the project, the source audit runs as part of the schedule too.

Notifications

SiteCMD only notifies you when a scan finds something that’s actually new or worse. The exact rules:

Score dropped by 10+ points since the last scan.
Any score drop combined with a new critical issue. Even a 1-point drop, if a confirmed critical appeared in the same scan, gets a notification.
First scan with criticals. If this is the project’s first scheduled scan and it found any criticals, you get notified.

A clean scan (no criticals appeared, score stayed flat or went up) does not notify. SiteCMD doesn’t pop alerts to tell you everything’s fine.

What the notification contains

A native OS notification with:

The project name and hostname
What changed (e.g. “Score dropped from 92 to 78”, or “New critical: missing security headers”)
A click action that opens SiteCMD to the relevant issue

Clicking the notification launches or focuses the SiteCMD window and navigates directly to the finding. On Linux, GNOME, and KDE, this works the same way it does for any other notification.

What runs when the app is closed

When you close the SiteCMD window, the app does not quit. It hides to the system tray. The tray icon stays visible (top of screen on macOS, near the clock on Windows, system tray on Linux) and the scheduler keeps running.

From the tray icon you can:

Open SiteCMD — show the main window again
Scan Now — manually trigger a scan from the tray, without opening the window
Quit — fully exit the app (scheduler stops, no more scheduled scans until you launch again)

If you actually want to quit, use the tray menu’s Quit option or the Quit shortcut. Just closing the window keeps things running, on purpose.

Power and battery considerations

The scheduler runs every minute to check for due schedules, but it doesn’t actually scan that often. The minute-tick is cheap: it reads from the local SQLite database and goes back to sleep. Actual scans only happen when something is due.

On a laptop on battery, expect scheduled scans to consume the same battery as opening a few web pages: small. The scheduler does not prevent the system from sleeping. If your laptop is asleep when a scheduled scan is due, the scan happens when the system wakes up (and the scheduler catches up on missed slots, running once for each missed schedule rather than skipping silently).

What schedules don’t do

They don’t push code changes. The scheduler runs scans. It doesn’t deploy, doesn’t update dependencies, doesn’t mirror to GitHub or Jira on its own.
They don’t escalate. SiteCMD’s notifications are local. No email, no Slack, no SMS. If you want findings pushed to a chat tool, use the webhooks integration (Pro tier).
They don’t run in the cloud. Scheduled scans run on your machine. If your laptop is closed and asleep, scheduled scans don’t run until it wakes back up. For uptime-style continuous monitoring, you want a service that’s hosted somewhere else (UptimeRobot, etc.) and the SiteCMD integration to pull that data in.

Disabling notifications

If you want schedules without notifications (e.g. you watch the dashboard yourself), you can mute notifications globally in Settings → Notifications, or per-schedule via the schedule row. Muted schedules still run; they just don’t pop OS notifications when they detect a regression.