Our production site loads normally for me, but the OptinStack scan fails or returns very few pages. We use a WAF and bot protection. Could that be the cause?
Yes. A firewall, bot-protection challenge, authentication wall, geo rule, or rate limit can allow a normal browser while blocking automated scanning. The scanner needs to load the public HTTPS pages visitors see.
Allow scanner access through the relevant WAF or bot-protection rule, confirm that sitemap.xml and the public pages are reachable, and rerun the scan. OptinStack does not scan logged-in areas or private origins that are not publicly accessible.
Documentation: Scanner access and WAFs.