The most useful scan is the one you didn’t have to remember to run. SiteCMD can run scans automatically in the background, alert you when something actually changes, and stay quiet otherwise.

This page covers how to set up schedules, what triggers a notification, and what runs when the app window is closed.

How scheduling works

Each environment of a project can run on its own schedule. SiteCMD’s scheduler wakes up every minute, checks which schedules are due, and runs them. When the app window is closed, SiteCMD stays in your system tray and the scheduler keeps running. You don’t need the app open.

A schedule is bound to one environment. If you want production scanned daily and staging weekly, set each environment’s card separately.

Setting up a schedule

Open Settings → Site Setup and select the environment you want to scan.
Find the Automatic Full Scan card.
Set Frequency to Daily or Weekly (Off turns it back off).
Pick a Time for daily, or a Time and Day for weekly.
Click Save.

The next scan time appears on the card. To schedule another environment, switch to it and set its card.

What runs

A scheduled scan runs the same engines as a manual one. If a source folder is linked to the project, the source audit runs as part of the schedule too.

Notifications

SiteCMD only notifies you when a scan finds something that’s actually new or worse. The exact rules:

Score dropped by 10+ points since the last scan.
A new critical appeared and the score fell. If the critical count went up since the last scan and the score dropped at all, you get notified.
First scan with criticals. If this is the environment’s first scheduled scan and it found any criticals, you get notified.

A clean scan (no criticals appeared, score stayed flat or went up) does not notify. SiteCMD doesn’t pop alerts to tell you everything’s fine.

What the notification contains

A native OS notification with:

The project name and hostname
What changed (e.g. “Score dropped from 92 to 78”, or “New critical: missing security headers”)
A click action that opens SiteCMD to the relevant issue

Clicking the notification launches or focuses the SiteCMD window and navigates directly to the finding. On Linux, GNOME, and KDE, this works the same way it does for any other notification.

What runs when the app is closed

When you close the SiteCMD window, the app does not quit. It hides to the system tray. The tray icon stays visible (top of screen on macOS, near the clock on Windows, system tray on Linux) and the scheduler keeps running.

From the tray icon you can:

Open SiteCMD - show the main window again
Scan Now - manually trigger a scan from the tray, without opening the window
Quit - fully exit the app (scheduler stops, no more scheduled scans until you launch again)

If you actually want to quit, use the tray menu’s Quit option or the Quit shortcut. Just closing the window keeps things running, on purpose.

Power and battery considerations

The scheduler runs every minute to check for due schedules, but it doesn’t actually scan that often. The minute-tick is cheap: it reads from the local SQLite database and goes back to sleep. Actual scans only happen when something is due.

On a laptop on battery, expect scheduled scans to consume the same battery as opening a few web pages: small. The scheduler does not prevent the system from sleeping. If your laptop is asleep when a scan is due, it runs once the system wakes back up.

What schedules don’t do

They don’t push code changes. The scheduler runs scans. It doesn’t deploy, doesn’t update dependencies, doesn’t mirror to GitHub or Jira on its own.
They don’t escalate. SiteCMD’s notifications are local. No email, no Slack, no SMS. If you want findings pushed to a chat tool, use the webhooks integration (Pro tier).
They don’t run in the cloud. Scheduled scans run on your machine. If your laptop is closed and asleep, scheduled scans don’t run until it wakes back up. For uptime-style continuous monitoring, you want a service that’s hosted somewhere else (UptimeRobot, etc.) and the SiteCMD integration to pull that data in.

Disabling notifications

If you’d rather watch the dashboard yourself, mute SiteCMD’s notifications at the OS level (macOS System Settings → Notifications, Windows notification settings, or your Linux desktop’s do-not-disturb). Scans keep running; you just won’t get pinged. To stop an environment’s scans entirely, set its Frequency back to Off.