Overview
An Authenticated Audit is a specialized scanning process that allows ObservePoint’s web crawler to bypass login screens to inspect "authenticated" areas of your website. While a standard audit only reaches public-facing pages, an authenticated audit uses stored credentials to access member dashboards, checkout sequences, and account settings.
It ensures that your data layer, analytics tags, and privacy compliance measures are functioning correctly in the most sensitive areas of your site—where high-value conversions and the handling of Personally Identifiable Information (PII) typically occur.
How to Set Up an Authenticated Audit
Setting up an authenticated audit requires configuring Pre-Audit Actions. These is a sequence of commands that tell the crawler exactly how to interact with your login form before it begins its scan.
1. Preparation & Permissions
Before configuring the audit, ensure your environment is ready:
Test Credentials: Use a dedicated "staging" or "test" account rather than a personal one.
IP Allowlisting: Ensure your IT or Security team has allowlisted ObservePoint’s static IP addresses so the crawler isn't flagged as a bot or a brute-force attack.
2. Configure Pre-Audit Actions
Create New Audit: Within the ObservePoint platform, create a new Audit.
Access Pre-Audit Actions: In the setup sidebar, select the Pre-Audit Actions tab.
Build the Login Sequence: Use the "Add An Action" button to build the following steps:
Navigate: Direct the crawler to your login URL.
Set Text/Input: Identify the username field (using a CSS selector or XPath) and enter the test username.
Set Masked Value: Identify the password field and enter the password. This value is encrypted for security, so no other ObservePoint users or even engineers could access it.
Click: Target the "Submit" or "Sign In" button.
Add a Verification Step: After the Click action, add a Wait time after the action (e.g., 2–3 seconds) or a Check action to confirm that a "Logout" button or "Welcome" message appears. This ensures the session is active before the crawl begins.
Conclusion
Implementing Authenticated Audits ensures your privacy compliance measures extend beyond the public eye and into the secure environments where sensitive user data is most vulnerable. By proactively scanning login-protected areas, you can detect data leaks or non-compliant tracking in real-time, safeguarding both your regulatory standing and your users' trust.