## TL;DR
A spider at 0 percent usually has nothing reachable to start from: the seed URL redirects to a login it cannot pass, the scope excludes the app paths, or the seed itself errors. Seed the spider with URLs copied from a manual browse of the authorized app, confirm the context scope includes them, and spider again while watching the fetched URL count climb.

```text
zap spider stalled at 0 percent on authorized web app
```

## Use this when
- The traditional spider sits at 0 percent or completes instantly with a handful of URLs on an authorized app.
- Manually browsing the app through ZAP shows many more pages than the spider found.

## Not for this skill when
- The app is a single page application whose routes never appear as links. Use the AJAX spider for that crawl.
- The seed URL is out of scope. A stuck spider is never a reason to seed a different host.

## Steps
1. Browse the authorized app manually through the ZAP proxy for a minute, opening the main sections, so real URLs land in the site tree. Verify: Verify: the sites tree shows the application structure you just visited.
2. Start the spider from one of those recorded URLs rather than the bare domain, and check the spider dialog shows that seed. Verify: Verify: the seed is an in-scope application URL that returned a normal page.
3. Open the context and confirm its include patterns cover the app paths and its exclude patterns do not swallow them, such as a broad logout or file extension exclusion. Verify: Verify: a known app URL matches the include rules when tested.
4. If the app needs login, configure the context authentication and a logged-in indicator, then spider with a user assigned. Verify: Verify: spider-fetched pages show authenticated content, not the login form.
5. Run the spider and watch fetched and queued counts move; save the resulting URL list as the coverage baseline for the scan. Verify: Verify: the spider completes with a URL count in line with the manual browse.

## Variant phrasings
### zap spider finds no urls seed from sites tree
The seeding phrasing.
### zap spider scope context include regex excludes app
The scope phrasing.
### zap spider login page stuck authenticated spidering
The authentication phrasing.

Compatibility: Compatibility: OWASP ZAP 2.x traditional spider; context include and exclude patterns use regular expressions.

## Why it happens
The traditional spider follows links from its seeds within the context scope. If the seed is a redirect to a login page, the only link is the login form; if scope patterns exclude the app, every discovered link is discarded as out of scope. Either way the queue empties immediately, which ZAP presents as a stalled or instantly finished 0 percent crawl.

## Edge cases / pitfalls
- Exclude logout and destructive action URLs before spidering an authenticated session, or the spider logs itself out and coverage collapses.
- A spider that finds thousands of calendar or search URLs is looping on generated links; add exclusions for those patterns.
- Record the final URL count and scope in the report, since spider coverage bounds everything the active scan can claim.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qFGcaR0Ouxi7RXWBjTybxg