Guides written by working testers

Website security, explained in plain English.

No jargon, no scare tactics. These are the security questions small-business owners actually type into Google, answered by the people who test websites by hand for a living.

What do these guides cover? The questions we get asked most: what a penetration test or security audit really costs, how to fix a hacked website, how to choose a security company, whether a scanner can replace a human tester, and what to do when a customer asks for a pentest report. Every guide is written by the same engineers who perform Bug Circuit’s manual audits (a free critical-bug check and a $49 one-time full audit with a written report), so the advice reflects what we see on real small-business sites, not vendor marketing.

Costs and prices

How much does a penetration test cost?Market prices, day and hourly rates, and yearly budgets.Website security audit costFrom free scanners to full pentests, and what drives the price.Cost to fix a hacked websiteWhat companies charge to clean up a hack, by tier.How fast is a penetration test?Typical turnaround times, from booking to report.

Your website was hacked

My website was hacked. What now?The first steps to take in the first hour.How to fix a hacked WordPress siteA safe, step-by-step cleanup.WordPress site keeps getting hackedFind the way back in, so it stops for good.Japanese keyword hackRemove the spam pages and get Google to drop them."This site may be hacked" warningWhat the Google search warning means and how to clear it.Search Console security issuesRead the report, fix the cause, request a review.

Choosing and buying a test

How to choose a penetration testing companyWhat separates real testers from scanner resellers.Choosing a cyber security company in Sri LankaTen checks, red flags and questions to ask.Manual vs automated penetration testingWhat a person finds that scanners miss.A customer asked for a pentest reportHow to unblock the deal quickly.Answering a security questionnaireHow to answer honestly with no security team.Penetration test before SOC 2When to test, and what auditors expect.

Checklists and self-checks

Is my website hackable?Seven signs attackers look for, and a free test.Website security checklist before launchEight checks before you go live.Small business security audit checklistA practical list you can work through yourself.Security glossarySQL injection, XSS, WAF, PCI DSS and more, in plain English.

By platform and business type

Wix, Squarespace and Webflow securityWhat the platform covers and what is still on you.Custom web app security auditWhat it covers and what it costs.SaaS, fintech and healthcare startupsTesting for teams that handle sensitive data.Indie hackers and solo foundersA real test on a small budget.

How we write these guides

Three rules. First, practical over dramatic: we don’t do fear-mongering, because most small-site risk is boring and fixable, and scaring you into a purchase is how the industry got its reputation. Second, priced for small business: when a guide mentions costs, we use real market numbers, including the awkward ones, and we’re upfront that our own $49 audit is a productized small-site scope, not an enterprise engagement. Third, written from casework: everything here comes from what we actually find when we audit websites by hand, not from recycled vendor content. If a guide says scanners miss access-control flaws, it’s because we keep finding access-control flaws that scanners missed.

Prefer answers about your own site?

Run the free passive check on your domain. No login, no charge, no impact on your site.

Ready for the full manual audit? See pricing