> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Step 2: Scope & Connectivity

> Define your target URLs and verify Mjolnir can reach them

This step has two parts: defining the URLs Mjolnir will test, and verifying it can actually reach them. Both happen on the same page.

## Part A: Target URLs & custom headers

### Adding target URLs

Enter the URLs that make up your application's scope. These are the endpoints Mjolnir will test.

```text theme={null}
https://app.example.com
https://api.example.com
```

You can add multiple URLs. Each one gets its own connectivity check and can have its own custom headers.

<Warning>
  Only add URLs you own and are authorised to test. Mjolnir will send real HTTP requests, including probes that may look like attack traffic, to everything in scope.
</Warning>

### Custom headers

Each URL can have custom HTTP headers attached. These are sent with every request Mjolnir makes to that URL.

Common uses:

| Header                  | Example value                           | Why                                                 |
| ----------------------- | --------------------------------------- | --------------------------------------------------- |
| Bypass rate limiting    | `X-Internal-Token: abc123`              | Stops your WAF from blocking Mjolnir's probes       |
| Route to staging        | `X-Forwarded-Host: staging.example.com` | Points traffic to a test environment                |
| Auth bypass for testing | `X-Test-Mode: true`                     | Skips CAPTCHA or bot detection on test environments |

Click **Add header** under any URL to add key/value pairs.

<Info>
  Not sure what headers to add? If your application uses a WAF like Cloudflare or AWS WAF, see [Part B](#part-b-connectivity-check--allowlisting) below. Allowlisting our IPs is usually more reliable than header bypasses.
</Info>

***

## Part B: Connectivity check & allowlisting

Once you've added your URLs, Mjolnir runs an automatic connectivity check. This takes a few seconds per URL.

### Status indicators

| Status                     | Meaning                                                                              |
| -------------------------- | ------------------------------------------------------------------------------------ |
| ✅ Reachable                | Mjolnir can reach this URL without issues                                            |
| ⚠️ Reachable with warnings | Requests are getting through but being flagged or throttled by a WAF or rate limiter |
| ❌ Unreachable              | Mjolnir cannot reach this URL at all                                                 |

### If you see ⚠️ or ❌

You'll need to add Mjolnir's IP ranges to your allowlist. This tells your WAF, firewall, or CDN to let our traffic through without interference.

See the full allowlisting guide:

<Card title="How to set up an allowlist for Mjolnir" icon="shield-check" href="/mjolnir/setup/allowlisting">
  Step-by-step instructions for Cloudflare, AWS WAF, and others
</Card>

Once you've updated your allowlist, click **Re-run check** to confirm the issue is resolved.

### Proceeding with connectivity issues

You can proceed even if connectivity issues remain, but you'll see a persistent warning banner. Unresolved connectivity issues will reduce test coverage because Mjolnir may miss endpoints it can't reliably reach.

<Card title="Next: Code & Documentation" icon="arrow-right" href="/mjolnir/code-and-docs/repositories">
  Select source repositories and upload supporting documentation
</Card>