How to get a penetration test for your website

The scope is the list of what may be tested. It drives the price, so get it on paper first.

• Domains: the main site and any subdomains, such as shop., app. or api.
• User roles: visitor, customer, staff, admin. Each one is tested for what it can see and do.
• Sensitive flows: login, password reset, checkout, file uploads, forms that store personal data.
• APIs and integrations your site depends on.
• What is out of scope: third-party services you do not own, such as your payment provider’s own servers.

Not sure what is exposed? The free Pulse scan maps your subdomains, technology and DNS without touching the site.

• Free scan ($0): known issues and public exposure. A good first look, not a penetration test.
• Manual audit of one website ($49 to $299): a person tests logins, roles, forms and checkout by hand and writes a full report. This fits most small business sites, WordPress and Shopify stores, and small SaaS.
• Agency penetration test ($5,000 to $20,000+): custom scope, several tester days, a formal report. Worth it for large custom platforms or when a contract names an accredited firm.

Not sure you need a test at all? Use the five-question check in do I need a penetration test. For market prices, see the penetration test cost guide.

• A person tests by hand, not only a tool with a logo on the report.
• They show a sample report before you pay. Here is ours.
• A fixed price for a written scope, so the bill cannot grow later.
• Retesting is included or priced up front.
• They ask for ownership proof and an authorization. A tester who does not is a red flag.

The full checklist is in how to choose a penetration testing company.

Testing a website without the owner’s permission is a crime in most countries, for example under the US Computer Fraud and Abuse Act, the UK Computer Misuse Act and Sri Lanka’s Computer Crimes Act No. 24 of 2007. So every real test starts with paperwork:

• Ownership proof: usually a code sent to an email at your domain, or a DNS record you add.
• A written authorization that lists the scope, the testing window and who to call if something goes wrong. Ours is the Authorization to Test.

• Take a fresh backup of files and database.
• Create test accounts for each user role in scope, so the tester can check what each role can reach.
• Tell the tester about anything fragile, such as a checkout that sends real charges or emails that go to real customers.
• Agree the testing window and a contact who can answer quickly.
• Do not change the site mid-test if you can avoid it, so the results describe what is live.

A useful report lists every issue with its severity, evidence, plain-English impact and exact fix steps. Fix the high and critical issues first, then ask for a retest to confirm the fixes worked. Keep the final report: customers and partners often ask for proof of testing, as covered in a customer asked for a pentest report.

Test again at least once a year and after big changes, such as a new login system, checkout or platform move.

• Free Pulse scan of your domain to see what is exposed. Run it.
• Choose a plan: Circuit, $49 one-time for a manual audit of one website, or Signal, $299 with fixes for the high and critical issues, a retest and 3 months of cover. Paid once by card through Stripe.
• Verify your domain by email code or DNS record, and sign the Authorization to Test online.
• A security expert tests your site by hand. Your audit starts on its own once those steps are done.
• Your report usually arrives within about 5 business days after verification, with every issue and its fix. You can message the team about any finding from your dashboard.

There is a 14-day money-back guarantee if testing has not started. Bug Circuit is not a PCI DSS QSA or a HIPAA auditor and does not issue compliance certifications.