Penetration test for PrestaShop, e-commerce and web systems
A structured security test of your shop, your admin area and the server underneath, carried out on your written authorization. You get a report that names the real problems and tells you what to fix first, in plain language. From €1,200.
From €1,200
PrestaShop or WordPress / Woo
External test of the shop, admin and APIs, with a written report and one fix-verification round. Final price depends on scope: number of hosts, custom modules, roles, APIs.
Work with meShop + Linux server
As above, plus the server underneath: exposure, patch level, SSH, services, TLS, backup access.
Work with meWHMCS
External test of the client area, admin and API, for hosting and service businesses that run on WHMCS.
Work with meA penetration test is not a scanner you can run yourself and feel safe: it is a time-boxed exercise where someone looks at your shop the way an attacker would, finds the weak spots, and writes up what matters. I do it on PrestaShop (1.6 → 9), WordPress and WooCommerce, WHMCS, and the Linux servers under them. Every test needs a written authorization from the owner of the system: no authorization, no test.
The point is not a 200-page report nobody will read. The point is a short, honest document that tells you where you are weak, which problem you should fix today, and which you can plan for later.
Does this sound familiar?
- A customer is asking for a security assessmentA B2B buyer, a certifying body, or your own insurance is asking you to show that the shop has been tested, and you need a credible report to hand over.
- The shop or admin have never been checkedThe site has grown over years, modules have come and gone, and nobody has ever actually looked for holes with intent.
- You just finished a migration or a big releaseBefore opening the new version to real traffic, you want to be sure nothing obvious is exposed.
- An incident scared youSomething strange happened, maybe just a close call. You want to find and close any other way in before it is used.
What I do, exactly
- External scope agreed in writingWe define what is in and what is out (domains, admin paths, APIs, server), the dates and the test window. Written authorization from the owner is a hard requirement.
- Automated and manual testingBoth: scanners find the obvious, hands-on testing finds the rest. For PrestaShop and WHMCS the manual part is where the real findings come from.
- OWASP ASVS as the baselineI use the OWASP Application Security Verification Standard as a checklist, so coverage is explicit and your team can see what was and was not looked at.
- Admin and authentication reviewLogin flow, password reset, session management, 2FA, admin privilege separation: the parts attackers try first.
- Server-side reviewServer exposure, patch level, TLS configuration, SSH, open services, backup access, file permissions.
- Written report, two audiencesAn executive summary non-technical readers can act on, and a technical appendix your developer or your hosting provider can use to actually fix the findings.
- Fix verification, one round includedAfter you fix the findings, I re-test the ones that mattered to confirm they are closed. One round is included.
How I work
- Scoping callThirty minutes to understand your systems, agree on scope, dates and what success looks like.
- Written authorizationYou sign a scope and authorization document before any testing starts. It names the systems, the dates and the people involved. Without this, the test does not start.
- Testing windowThe test is done inside the agreed window, usually five to ten working days depending on scope, with daily status if you want it.
- Report and read-throughYou receive the report, then we go through it together in a one-hour call, so you leave with a clear plan: what to fix today, this month, this quarter.
- Re-testAfter your team fixes the findings, I verify the fixes on the items that matter. Included in the price.
Why work with me
- I write and run the systems I test onMore than twenty PrestaShop modules in production, Linux servers I keep online every day, WHMCS systems I develop and operate. I know where the real holes are because I ship the same code.
- Reports people actually readShort, prioritized, in plain language. Not a dump of scanner output.
- Clear legal footingEvery engagement starts with a written scope and authorization document signed by the owner of the system. I do not test anything I am not explicitly allowed to.
- Italian invoicing and a real personItalian VAT number, electronic invoice, and the same person before, during and after the test.
Questions, answered
Can you test a shop that is not yours?
Only with a written authorization from the owner of the shop and of the server. The authorization names the systems, the dates and the people involved. Without it, I do not start.
Do you test production or a copy?
It depends on scope and risk. For noisy tests we use a staging copy. For checks that need to be realistic, we test production inside an agreed window, with careful traffic shaping to avoid taking the shop down.
Will the test take the shop down?
The goal is to find problems without causing an outage. I avoid destructive techniques on production, rate-limit where needed, and stop immediately if something looks fragile. If a test can only be done safely in staging, we do it in staging.
What happens to the findings?
They go to you. I do not publish, sell, or share them with anyone. The report is encrypted on delivery and I delete my working copies after the agreed retention period.
Do you issue a certificate?
I do not issue official certifications: those come from accredited bodies. What you get is a written report that your customer, insurer or certifying body can read and verify.
How often should I do this?
Once a year is a reasonable baseline for most e-commerce shops, plus a shorter re-test after any major release or migration.
Related work
To go deeper
Tell me what’s not working, or not talking to what.
New build, a system that needs rescuing, an integration, EU compliance (withdrawal button, GPSR, accessibility). One developer who builds it and stays to run it. I reply within one business day.
Prefer email?
luca@cavallini.net