I started using the service and insert my key, I configure it to perform the scan in the directory / var / www Is it normal to take several hours? Or am I doing it wrong? Should I scan site by site?
Maybe on a huge server with terabytes of data. This also depends on how fast your disk system is and what other disk activity occurs during scan. My host now has SSD disks, but when it had rotating disks scan slowed it down something terrible. I set it to scan /var/www/clients, since that is where the files really are. The /var/www is mostly symlinks. It may be websites get scanned twice when using your way.
You are talking about using a service and not the software, does this mean that you are using the FTP connector and not the ISPProtect (ispp_scan) application? To scan a whole sderver, the ISPprotect application should be downloaded and used locally on the server, the FTP connector is only for scanning single websites and not whole servers as FTP is quite slow.