Dev License: This installation of WHMCS is running under a Development License and is not authorized to be used for production use. Please report any cases of abuse to abuse@whmcs.com

Penetration testing of web apps, shops and websites

A pentest is a controlled attack on your system before someone does it for real. You get a list of real vulnerabilities, a risk rating and guidance on what to fix first. Not a raw scanner printout.

Describe what you want tested
  • OWASP WSTG methodology
  • CVSS risk rating
  • Retest included

What we test

  • Websites and shops

    WordPress and WooCommerce: plugins, themes, configuration and admin panels. Takes 3 to 5 working days.

    from 4,900 zł net

  • Web apps and APIs

    Login, sessions, access control between accounts, business logic and APIs. Takes 1 to 2 weeks.

    from 12,000 zł net

  • Larger systems

    Several applications, servers, service configuration and tests repeated over time.

    individual quote

Penetration testing and vulnerability scanning

A scan finds known weaknesses. A penetration test proves what can really be exploited.

Feature Vulnerability scan Penetration test
Method Automatic Manual, using tools
Time Minutes to hours From a few days
What it finds Known, published vulnerabilities Also logic and permission errors
False alarms Common Every finding verified
How often Regularly Once a year and after major changes

The test step by step

  1. Scope and quote

    We agree what we test and what must not be touched. You get a fixed price, and nothing starts without written consent.

  2. Test and report

    We exploit vulnerabilities in a controlled way. The report has a risk rating, guidance and a jargon-free summary.

  3. Fixes and retest

    We apply the fixes or hand them to your team, then check that the vulnerabilities are gone.

Who security testing is for

Online shops and portals with login

Customer data, order history and user accounts. The most common error is being able to view someone else's data by changing an ID in the address.

Law firms, accountants and clinics

Confidential documents and health data need special protection. A test documents that unauthorised people cannot reach them.

Suppliers to larger companies

More companies ask about security testing before signing, and a report can be a condition of working together.

After changing developer

After taking over a site from another company, check for active access, forgotten panels or code nobody ordered.

Penetration testing questions

Is your question not here?

Call or write. We will explain it in plain words.

+48 791 748 958 info@hostlix.pl

What does a penetration test cost?
A company site or smaller shop starts from 4,900 zł net and an application with login from 12,000 zł net. The price depends on the number of features, user types and APIs.
What is a penetration test?
A controlled attack on your systems, agreed with you. A specialist looks for vulnerabilities as an intruder would, but the result goes into a report.
How long does a penetration test take?
A company site or WordPress shop takes 3 to 5 working days, a web app with login and APIs 1 to 2 weeks. Scope and dates are agreed in writing before we start.
What is in the report?
A list of the vulnerabilities found with a CVSS risk score, guidance on fixing them and a plain-language summary. You can see straight away what to fix first.
Who fixes the vulnerabilities?
We can apply the fixes ourselves or hand them to your team or your site developer. Then we check that the vulnerabilities are gone.
Is a retest included?
Yes. After the fixes we check again that the vulnerabilities are really gone.
How often should we run a security test?
Usually once a year and after every major change, such as a new shop module or a change of developer. An automated vulnerability scan is worth running more often, but it does not replace a test.
What methodology do you use?
OWASP Web Security Testing Guide, and OWASP API Security for APIs. We test together with a security specialist we work with permanently.

Have an idea for a website, shop or app?

Describe what you need in a few sentences. We come back with scope, deadline and price before anything starts.

  • A binding quote before we start
  • New scope only with your approval
  • No obligation
Request a quote Contact us

Powered by WHMCompleteSolution