How can we do our own site security testing, and what should we check before a pentest?

Testing things yourself first is a very smart move. If you start a pentest while there are simple, known flaws on your server, the final report will just be pages of telling you to update your packages, which wastes your money. Lock your own front doors first, then let the expert test how solid the deadbolts are.

We were in a similar spot last year. We couldn't afford a 4,000 EUR budget, so we spent 3 days updating all our software packages and fixing HTTP headers. The narrowed-down scope pentest we ordered after that only cost 1,800 EUR because the expert stepped into a clean, prepared system.

Do this tonight: create two different B2B test accounts on the site. Log in with one and place an order, then copy the order ID from the URL and try opening it in the second user's browser. If the other user's data loads, you've just caught your biggest vulnerability for free.

Don't rely too heavily on off-the-shelf open-source security scanners off the web. They usually generate thousands of false alarms, which will overwhelm your developer and might cause them to miss the genuinely critical authorization flaws.

Here is the bare minimum checklist you can do yourselves: 1) Prevent error messages from displaying server software and database versions. 2) Add rate limiting to your login screens to stop brute force attempts. 3) Make sure database backup files haven't been left behind in a public web directory.

Tell your dev not to sweat it, there are great free analysis sites out there that grade your security headers. You plug in the URL and it gives you a grade from A to F. tbh just putting in the work to get that grade up to an A will tighten the system up considerably.

forgotten test accounts and weak passwords on the admin panel open the door to more than half of external attacks, check everyones passwords and 2fa before running automated scans imo.

Please make sure to run your internal testing outside of business hours and on a backup copy of your live environment. Heavy automated traffic can trigger database deadlocks or service downtime in production.

I have a question. When you try to change everything at once, nothing settles.

This is my opinion, I'm not claiming it's absolute truth.

Noted, thanks. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Having backups accessible on the same network and with the same identity makes them part of the target.

The most overlooked point about site security testing is this: The biggest time-waster for us was not knowing who had the final say.

Of course, it varies if your situation is different.

Let me summarize what's been said so far. If you scold false alarms, nobody will report again.

I'm also curious if anyone does it differently.

Noted, thanks.

Let me summarize the topic, since several different answers were given. The real issue isnt the number, but what its based on.

If you post the result here, it will help others too.

this is exactly what we experienced and if you scold false alarms, nbody will report again.

this is my opinion I'm not claiming it's absolute truth.

I'll try it.

let me summarize the topic since several different answers were given then like any unwritten clause becomes a point of disagreement later as both siddes remember it differently.

i'm also curious if anyone does it differently.

Timely topic.