CMS Website Penetration Test

A fixed-price, CREST-accredited penetration test of a WordPress, Joomla or similar CMS website, including school and college public-facing sites, tested unauthenticated. Not for online shops or learning platforms. Manual testing by a senior tester.

What we test

• One CMS website (WordPress, Joomla or similar)
• Tested unauthenticated, as an anonymous visitor
• Vulnerable or outdated CMS core, plugins and themes
• Injection and cross-site scripting (XSS)
• Security misconfiguration and exposed admin or login
• Information disclosure and common OWASP issues on the public surface

What is not included

Authenticated or user-role testing, custom application logic beyond the CMS, online shops, and learning management systems (an LMS such as Moodle or Canvas). Need any of these? We will quote them separately.

Running an online shop? A flat fee cannot do a checkout, accounts and payment flows justice, so we scope shops properly. Tell us about yours and we will quote it.

Ideal for school and college public-facing websites, prospectuses, news and information sites. It is not for a learning management system (an LMS such as Moodle or Canvas): those are authenticated, application-heavy platforms that we scope and quote separately.

Why CREST-accredited testing matters

CREST is the industry body for penetration testing. CREST accreditation means our methodology, reporting, data handling and tester competence have been independently audited against CREST’s standard, not simply claimed. Solusec holds CREST company accreditation, our lead tester is CREST registered as an individual, and we hold CREST’s AI-Enabled Penetration Testing accreditation. In practice that means genuine manual testing by a qualified, vetted tester, not an automated scan dressed up as a pentest, and a report that clients, insurers and auditors will accept.