Do I need a penetration test? A quick check

A penetration test is a person trying to break into your website the way an attacker would, with your written permission, and writing down what they found and how to fix it. It is not the same as a scan, which only checks for known patterns. More on that difference in manual vs automated penetration testing.

• Has anyone asked for one? A customer’s security questionnaire, a contract, an insurer or an auditor. If yes, you need one, and you need a report you can share. See a customer asked for a pentest report.
• Can people log in? Customer accounts, a members area, staff or admin roles. Each role must be tested for what it can see and do. Scanners cannot check this.
• Do you take payments or store personal data? Checkout, bookings, forms with names, emails or files. A flaw here costs real money and trust.
• Did something big change? A new site, a platform move, a new login system, checkout or API. Old test results no longer describe the new site.
• Were you hacked, or warned? A spam redirect, a “Deceptive site ahead” screen or a Search Console security warning. After the cleanup, a person should find how the attacker got in. Start with my website was hacked.

If you answered no to all five, you probably do not need a penetration test yet. Run the free security check, keep your platform and plugins updated, use unique passwords with two-factor login and keep backups. If you answered yes to any, a person should test your site.

Prices for agency tests come from senior human hours: roughly $900 to $2,200 per tester day. Our penetration test cost guide explains the market in detail.

Many people ask because a framework came up. Here is the short version. In every case your auditor, acquirer or advisor has the final word, so ask them before you book.

• SOC 2: the criteria do not say “penetration test” in plain words, but auditors usually expect one as evidence. See when to get a penetration test before SOC 2.
• PCI DSS: requires penetration testing at least every 12 months and after significant changes for systems in scope. How much applies to a small merchant depends on how card data is handled.
• ISO 27001: does not name penetration testing as a mandatory control, but its controls on technical vulnerabilities and security testing are commonly met with one.
• HIPAA: requires a risk analysis and regular evaluations. A proposed update published in January 2025 would require a penetration test at least every 12 months. Check its current status.

Bug Circuit is not a PCI DSS QSA or a HIPAA auditor and does not issue compliance certifications. Our report is evidence that a person tested your website, never a certificate.

• See what is exposed first. The free Pulse scan is passive: nothing touches your site.
• Write down the scope: which domains, which user roles, which APIs.
• Pick a tester who tests by hand and shows a sample report. Our buyer’s checklist lists the questions to ask.
• Follow the steps in how to get a penetration test, from scope to the final report.

With Bug Circuit, Circuit is a $49 one-time manual audit of one website with a full written report. Signal is $299 and adds fixes for the high and critical issues, a retest and 3 months of cover. Reports usually arrive within about 5 business days after you verify your domain. See pricing or a sample report.