E-commerce penetration testing for stores and marketplaces

What we test in an online store

We test how your system uses its integrations — KYC, payment, bank and eID services.

Two-sided marketplaces

On a two-sided marketplace, we test access across buyer, seller and admin roles.

Seller permission checks examine whether one seller can reach another seller’s listings, orders or customer data. We also test whether a buyer can reach seller or admin functions.

For money movement, including refunds and payouts, see penetration testing for payment flows.

New store, replatforming and peak season

1. Plan for the store change or trading peak
   Include penetration testing in your preparations before important business events or launches, such as a new store, replatforming or a seasonal sale.
   
   When testing can start depends on our current schedule. If you need it sooner, contact us and we will do our best to accommodate you.
   
   Testing takes from a few days to a few weeks, depending on the project. The average testing period is 1–2 weeks.
2. Identify the checkout and store interfaces
   Every test starts with planning: we agree the scope, the systems to test and the rules that avoid disruption.
   
   We scope each test with you, either through our scoping questionnaire or in a scoping meeting where we ask the same questions.
   
   Choose one testing approach for your store: black-box, grey-box or white-box, agreed at scoping.
3. Select the store environment
   We test on live systems and on staging environments. Roughly 70% of our tests run on live systems and 30% on staging.
4. Work around sale periods
   Bring your trading peaks and sale dates into the scheduling discussion.
   
   Testing is conducted under controlled conditions with agreed rules of engagement. We schedule around your business needs.

Buying or selling a store

If you are buying or selling a store and ask for an “e-commerce security audit”, we provide a penetration test or a vulnerability assessment.

A buyer may commission the test before the deal closes, or a seller before putting the store up for sale.

The scope can cover the store’s custom checkout, plugins, inventory and partner APIs, admin access and, where present, its mobile app.

Our reports include an executive summary, the scope of work, the test type and methods, the methodology, how risk is calculated, a summary of findings, detailed results for each finding, and a conclusion.

Report and retest

Every report lists the vulnerabilities found, rates each by risk, and gives remediation steps. A penetration test report also sets out the exploitation methods demonstrated during testing, and a priority-based action plan.

Whether the test covers checkout, store APIs or admin access, each finding is rated by severity in a report of 20–100+ pages.

After you fix the findings, we re-test them.

A retest covers the findings only, not the full application. It is usually quoted in the same offer as the test. The retest window is about 4 weeks, or sooner if you have fixed the findings earlier and our schedule has an opening.

You can request our sample web application penetration test report through the contact form or by email.

Experience and method

With over 7 years of experience in testing, we have built extensive expertise in web applications and websites, e-commerce platforms, mobile applications, APIs and SaaS solutions.

Our penetration tests can follow OWASP, ISSAF, PTES or OSSTMM at your request or on our recommendation. What we follow and how much of it we cover are agreed at scoping.

Testing uses Burp Suite, manual testing and our own tools.

Our pentesters hold certificates including PNPT, eCPPTv2, CAP, CompTIA PenTest+ and CompTIA Security+, and their published research includes five CVEs.

Questions

Do we need a penetration test if a PCI-compliant provider takes the payments?

Under PCI DSS v4.0.1, whether a merchant needs a penetration test depends on how it takes card payments. A store that hands its whole payment page to a PCI DSS-compliant provider and qualifies for SAQ A generally has no Requirement 11.4 test. SAQ A-EP includes one. Your acquirer or QSA confirms which applies.

How often does PCI DSS require testing, and which parts can you cover?

PCI DSS v4.0.1 Requirement 11.4 requires internal and external penetration testing at least once every 12 months and after significant changes, including network-layer testing and, where segmentation is used, segmentation testing. We test the web applications, APIs and mobile apps in your PCI DSS scope. We do not perform network-layer or segmentation testing, so our test covers part of Requirement 11.4. We are not a QSA and do not certify PCI DSS compliance.

Can you test our custom checkout, discounts and admin access?

An e-commerce test can cover custom checkout, coupon, voucher and gift-card logic, inventory APIs and admin consoles.

For example, we check whether changing a cart request bypasses a discount rule or whether a customer account can use an admin function.

What changes when the store is a two-sided marketplace?

Marketplace testing includes the permissions that separate buyers, sellers and administrators.

For example, we check whether a seller can alter an account update request to grant themselves admin permissions.

Can you test a store built on an e-commerce platform?

Most of the online stores we test are self-hosted solutions built for the client, in-house or by a contractor. We also test stores built on platforms such as Shopify and WooCommerce. What we test depends on your request: your entire store, or only part of it, such as a custom app or theme.

How far ahead of a store launch, replatforming or peak season should we arrange testing?

Arrange penetration testing before your store launch, replatforming or peak season, allowing for both the testing period and the available start date.

Testing takes from a few days to a few weeks, depending on the project. The average testing period is 1–2 weeks.

When testing can start depends on our current schedule. If you need it sooner, contact us and we will do our best to accommodate you.

What determines the price of testing our store?

Penetration testing prices reflect the scope of your store: how many systems or applications need testing, the testing type, the environment’s complexity and the timeline.

Use the common cost and planning answers when preparing your store’s testing brief.

What does penetration testing add to a vulnerability assessment of our store?

A vulnerability assessment scans your systems with Burp Suite, and an expert verifies and prioritises what the scan finds. A penetration test goes further: testers try to exploit what they find and show you the impact.

Compare the methods and deliverables for penetration testing and vulnerability assessment.

Related services

• Web application security testing
• Mobile application security testing
• API security testing
• Penetration testing
• Vulnerability assessment