Website Security Testing
Website Security Testing Services
Practical security testing for public-facing websites, CMS-driven sites, corporate websites, and brochureware. Identify real risks before someone else does.
- CREST member company
- Consultant-led testing
- Transparent pricing
Website Security Assessment
What our testing covers
We test your site's public-facing attack surface by hand: exposed admin panels, outdated CMS versions, misconfigured headers, and the other issues a scanner flags but doesn't confirm.
The service is for organisations that want independent assurance that their website doesn't present unnecessary risk, without needing a full web application penetration test. It suits corporate websites, CMS-driven sites and brochureware, which are often overlooked from a security perspective.
The result
What you get
A working list of what's actually exploitable. Not a raw vulnerability count.
Who This Is For
Is website security testing right for you?
If your site is primarily informational, CMS-driven, or used for marketing and lead generation, this is the right starting point.
Get a Website PentestCorporate and brochureware websites
Company websites are often overlooked from a security perspective. Outdated CMS versions, exposed admin panels and weak headers are common targets.
WordPress and CMS-based websites
Plugin vulnerabilities, theme weaknesses and default configurations on WordPress, Drupal and Joomla are routinely exploited by automated and targeted attacks.
Agency-managed client websites
Agencies managing websites on behalf of clients often lack the in-house capability to perform independent security assessments.
Sites with basic forms and contact functionality
Contact, quote and newsletter forms introduce input handling and data exposure risks that warrant review, even on simple websites.
Important Distinction
When you need more than a website assessment
Website security testing covers your public-facing website and isn't a substitute for a full test of a complex, custom or authenticated application. If your site includes any of the following, you most likely need a web application penetration test instead.
- Customer portals or dashboards with authenticated user sessions
- SaaS platforms with user accounts and business logic
- Payment flows or checkout processes handling financial transactions
- APIs powering mobile applications or third-party integrations
- Multiple user roles with privilege separation
- Applications processing personal, financial, or sensitive data through complex workflows
Pricing
From £750
for website security testing
Scope is based on the size and complexity of your site, not the number of pages. A 30-minute scoping call is free and gets you a fixed written quote.
No obligation · Strictly confidential · Reply within one business day
Pricing Examples
| Static or simple brochureware site | £750 - £1,100 |
| CMS site (WordPress, Drupal, Joomla) | £1,100 - £1,600 |
| CMS with multiple plugins, forms, or third-party integrations | £1,600 - £2,200 |
| Multi-site or larger CMS deployments | £2,200+ |
Indicative ranges only. Your exact price is confirmed after a short scoping conversation. See full service pricing.
Compare all our penetration testing services.
What's Included
- Fixed-price proposal agreed before testing starts
- Manual, consultant-led testing. Not automated scans
- Report within 2 business days, with findings in priority order and remediation guidance specific to your CMS or platform
- Free focused retesting included to verify remediation
- Debrief call, useful when handing findings to your agency or developers
What We Test
What does a website security assessment cover?
Testing focuses on the external, publicly accessible attack surface of your site and is targeted at real-world risks rather than automated scan output.
01
CMS, Plugin, and Theme Exposure
Identification of outdated CMS versions, vulnerable plugins, and insecure themes that are known to be exploited.
02
TLS and SSL Configuration
Assessment of your certificate configuration, cipher suite strength, protocol versions, HSTS settings, and mixed content issues that could undermine secure connections.
03
Security Headers
Review of HTTP security headers, including Content Security Policy, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Missing or misconfigured headers are a common finding.
04
Exposed Admin and Login Panels
Discovery and assessment of publicly accessible administrative interfaces, login pages, and management portals that should be restricted or protected.
05
Contact Forms and Input Handling
Review of how contact forms, search fields, and other inputs handle user-supplied data, including email header injection, basic XSS, and spam abuse potential.
06
Directory Listing and Exposed Files
Identification of directories with open listing enabled, backup files, configuration files, and other artefacts that are unintentionally accessible to the public.
07
Known Vulnerable Components
Detection of JavaScript libraries, server software, and third-party components with known vulnerabilities (CVEs) that are visible from the public attack surface.
08
Hosting and Deployment Indicators
Externally visible server configuration details, version banners, cloud provider metadata exposure, and deployment artefacts that provide useful reconnaissance information to attackers.
09
Public Attack Surface Enumeration
Discovery of subdomains, exposed services, and publicly accessible resources associated with your domain that fall within the agreed scope of assessment.
10
Sensitive Information Disclosure
Identification of internal paths, credentials, API keys, or configuration data inadvertently exposed in page source, JavaScript files, robots.txt, or accessible endpoints.
Ready to assess your website's security?
Tell us about your site and we'll reply within one business day to confirm the scope, then send a fixed-price proposal.
Common Questions
Website security testing: frequently asked questions
Website security testing starts from £750 for a simple brochure site. A typical CMS site costs £1,100 to £1,600, CMS sites with multiple plugins, forms or third-party integrations cost £1,600 to £2,200, and larger multi-site deployments are priced from £2,200. Plugins, forms, custom code and the number of sites in scope drive the price, rather than the page count.
Our penetration testing pricing guide compares costs across every service.
Website security testing is scoped to the publicly accessible, largely unauthenticated attack surface of a business website (such as a corporate site, CMS-driven platform, or brochureware site).
Web application penetration testing goes further and covers authenticated workflows, user sessions, business logic, APIs, and role-based access controls. If your site has logins, customer accounts, payment flows, or complex functionality, you need a web application penetration test rather than a website security assessment.
Most website security assessments take 1-2 days depending on the size and complexity of the site or if there are multiple sites in-scope for testing. Reports are delivered within 2 business days of testing completion.
Yes. WordPress is the most widely deployed CMS and one of the most targeted platforms on the internet. Our assessment covers WordPress core version exposure, plugin and theme vulnerabilities, wp-admin exposure, XML-RPC abuse potential, user enumeration, and common misconfigurations. The same depth applies to other CMS platforms.
Yes. Many of our website security assessments are commissioned by organisations whose sites are managed by a third-party agency.
Prior to testing, we will discuss the scope of the assessment and provide a written proposal. We can work with your agency to coordinate testing and remediation, or you can choose to manage that process internally.
Website security testing is designed to be non-disruptive. We do not perform denial-of-service testing or actions that would degrade availability. Where any test could potentially affect a site's behaviour, we discuss this with you in advance. Testing can be scheduled outside business hours if preferred.
Subdomain enumeration and testing of associated subdomains can be included within scope, which we agree during the scoping call. If you have a known set of subdomains you want assessed, bring them to the scoping conversation and we will factor them into the proposal.
An independent website security assessment provides documented evidence of third-party security review, which is useful for ISO 27001 evidence packs, supplier due diligence questionnaires, Cyber Essentials preparation, and internal governance requirements.
Annual testing is a sensible baseline, but we also recommend re-testing after any significant updates, CMS migrations, plugin additions, or redesigns as each change can introduce potential risk. Organisations with higher risk profiles or compliance obligations may benefit from more frequent assessments.