Is a free penetration test safe? What to check first

The short answer

A free penetration test is safe when it’s run with the same controls as a paid one: proof that you own the website, an agreed scope, written authorisation and confidential reporting. If any of those are missing, be cautious.

Questions to ask any provider

• Do they make you prove you own the website before testing?
• Will they agree the scope, exclusions and testing window in writing?
• Can you choose a staging copy instead of your live site?
• Do they avoid destructive or high-volume techniques?
• How are findings delivered — securely, or as an email attachment anyone could forward?
• Is there any obligation to buy something afterwards?

Warning signs

• Testing starts before you’ve agreed anything in writing
• Pressure to buy a paid service to see your results
• Findings sent by unencrypted email
• No clear contact details or company information

How AI Pentest handles it

We verify ownership with a DNS record or verification file, agree scope and timing in writing, record your authorisation before testing, and share findings only through your secure, sign-in-protected portal. There’s no payment and no obligation.