---
title: "Whitelist Vulnerabilities"
url: "https://docs.indusface.com/en/article/whitelist-vulnerabilities"
language: "en"
last_updated: "2026-04-10T10:16:03.177Z"
---

# Whitelist Vulnerabilities

Whitelisting allows you to exclude a vulnerability from remediation workflows when it is accepted as a risk or considered non-impactful. Critical Severity vulnerabilities cannot be whitelisted.

You can initiate whitelisting directly from the **Vulnerabilities ->** **LIST OF VULNERABILITIES DETECTED** section using the **Whitelist** action.

![](https://cdn-assets.productfruits.com/1e5a9518-e938-40a6-ba75-06e5e5d4db3c)

When you click **Whitelist**, the **Confirm Whitelisting** window is displayed.

![](https://cdn-assets.productfruits.com/5ad54e80-5df5-4eb2-b835-e6e4342539d1)

Whitelisting Modes

| **Mode** | **Description** |
| --- | --- |
| Vulnerability | Applies only to the selected vulnerability instance (specific URL + parameter) |
| Vulnerability Category | Applies to all vulnerabilities under the same category (e.g., ORM Injection) |

> Use **Vulnerability** when the vulnerabilty is isolated   
> Use **Vulnerability Category** when the pattern is consistently acceptable 

![](https://cdn-assets.productfruits.com/1fdbe7e2-bcde-407e-b068-e726688f870e)

You must choose how the whitelist should be applied and define its duration.

### **Whitelisting Duration**

| **Option** | **Description** |
| --- | --- |
| Whitelist Until | Temporarily ignores the vulnerability until the selected date |
| Indefinitely | Permanently whitelists the vulnerability or category |

> Temporary whitelisting is safer. Indefinite should only be used if you are absolutely sure

### **Whitelisting Parameters**

| **Field** | **Description** |
| --- | --- |
| Plugin | Vulnerability category (auto-filled, e.g., ORM Injection) |
| URL | Affected endpoint (visible in Vulnerability mode only) |
| Vulnerability Id | Unique identifier of the vulnerability (auto-filled) |
| Reason | Mandatory justification for whitelisting |

### **Confirmation**

Click **Confirm** to apply the whitelist.

Once applied:

-   The vulnerability moves to the **Whitelisted** tab 
-   It is excluded from remediation tracking 
-   It will not trigger further alerts or actions

![](https://cdn-assets.productfruits.com/137543ab-2266-46d8-92ea-d4d41f7e849f)

## UnWhitelist Action

The **UnWhitelist** action allows you to restore a previously whitelisted vulnerability back into the remediation workflow.

This option is available in the **Whitelisted** tab under the **Actions** column

![](https://cdn-assets.productfruits.com/ccd01cdf-8877-4f76-a36d-c67ecbdbdcd0)

![](https://cdn-assets.productfruits.com/ac1fd23f-0f8e-4584-b6fb-6213adbf589f)

-   Select the URL and click Unwhitelist. 
-   A confirmation pop-up appears.  
-   Enter a reason for unwhitelisting, select a date till the URL to be unwhitelisted, and then click Confirm.