Penetration testing
Automated penetration tests for domains you own
We test your website and server for known vulnerabilities and misconfigurations, once or every month. Only after you prove the domain is yours.
Permission first
Verification is the line, not the price
Reading public DNS is fine for anyone. Testing a website is not, unless its owner says so. You prove control of the domain, and that proof is your written permission for the test.
- 01
Create a project
Enter the domain and choose what to test: which hosts and URLs, and when. - 02
Add a file
Put a file with your token on your site; a TXT record in your DNS is optional. After you press Verify we keep checking for 24 hours. - 03
Confirm the scope
You confirm you own the target or are allowed to test it. We timestamp that record.
The record you add looks like this:
- Type
TXT- Name
example.com- Value
offensly-verification=7f3c9a1e5b2d4c8f- TTL
300
Keep it in place while you test. We check it again right before every test; if it is gone, the test does not run.
What we test
The weaknesses attackers look for first
TLS and certificates
Security headers and cookies
Known vulnerabilities
Exposed files and misconfiguration
Every finding comes with its severity, the evidence we saw and how to fix it. On each new run you see which findings are new, which are fixed and which came back.
Next to manual testing
Automated every month, manual when it matters
What automated testing is good at
Known vulnerabilities, outdated components, weak TLS, missing headers, exposed files. The things attackers scan the whole internet for, checked on your site every month at a fraction of the cost of a manual test.
Manual testing, on request
A manual penetration test by a specialist finds business-logic flaws and chained attacks no scanner sees. We do those too: tell us what to test and when, and we send a scope and a price. Then Offensly covers the months in between.
Ask for a manual testpentest@offensly.com
Pricing
Test once, or keep testing
New vulnerabilities are published every day. Continuous testing is how you notice them on your site.
Continuous testing
RecommendedA full test now, then a retest every month for a year.
$180per domain · per year
$15 a test, paid yearly in advance
85% less per test than one-off tests
- A full test right away that sets your baseline
- An automatic retest every month, 12 tests a year
- New, fixed and returning findings on every retest
- Advanced DNS checks (5 a day), as in the free account
- Timestamped proof of permission for every test
- Renews every year; cancel any time before the renewal
One-off test
A single full test when you need it.
$100per test
- One full web penetration test
- Findings with severity, evidence and fixes
- Timestamped proof of permission
- $80 off continuous testing of the domain within 30 days
FAQ
Before you start
Can a test take my website down?
Tests run only in the time window you choose, so you can schedule them outside busy hours. Tell your hosting provider if their terms require notice of security testing.
My firewall blocks unknown scanners. What do I do?
The dashboard shows the address our tests come from, so you can allow it for the test window.
Can I test a site I do not own?
No. You can only test a domain or IP address you have verified, and you confirm you are allowed to test it. Testing someone else's site without permission is illegal in most countries.
What proof of permission do I get?
Each verification and each test is recorded with the DNS answer we saw, your confirmed scope and a qualified eIDAS timestamp. You can download that record from the project.