A free penetration test for your website or web app

What we look for

• Broken access control — seeing or changing data that belongs to someone else
• Injection flaws such as SQL injection and cross-site scripting (XSS)
• Weak login, password reset and session handling
• Exposed admin pages, files, backups or debug information
• Missing or misconfigured security headers and HTTPS settings
• Outdated software and components with known vulnerabilities
• API endpoints that trust the browser too much

Who it’s for

UK businesses with a public website, online shop, customer portal or SaaS product — especially if you’ve never had a security assessment, have recently launched or changed something significant, or are being asked about security by customers or insurers.

What you receive

• A confidential report shared through your secure portal — never emailed as an attachment
• Each finding rated by severity, with evidence and a plain-English explanation
• Practical guidance on how to fix each issue

Safe and authorised by design

We only test websites you’ve proved you own, using a DNS TXT record or a verification file. Testing starts only after we’ve agreed the scope, exclusions and testing window and you’ve given written authorisation.

Common questions