Penetration testing and vulnerability scanning
You’re welcome to have your website or server penetration tested or scanned for vulnerabilities. What we need from you depends on the type of hosting you have.
Shared hosting
Your site shares a server with other customers, so testing has a few extra rules.
Tell us at least one working day before testing starts. Open a ticket with the details listed under “What to send us” below.
What you can’t test, even with notice:
- Other customers’ websites or accounts. Only test domains and services that belong to you.
- The server itself, including the control panel, SSH, and the shared mail and FTP services.
- Load, stress or denial of service testing.
- Brute force or password guessing against any login.
If a test affects the server. Our systems can block testing traffic automatically, and we’ll block it ourselves if testing starts to affect the server as a whole, for example by slowing it down for other customers. We may not always be able to tell you when this happens. If your tester finds their traffic is no longer getting through, open a ticket and we’ll check whether it’s been blocked and why.
Managed VPS and dedicated servers
If we look after your server for you, you must tell us before testing starts. Testing can set off our monitoring and security alerts, and we need to know the traffic is expected. Open a ticket with the details listed under “What to send us”.
Unmanaged VPS and dedicated servers
You can test your own server as you see fit. We still recommend telling us beforehand, so we recognise the traffic if we see it.
What to send us
Open a ticket with:
- the domains, IP addresses or servers to be tested
- the dates and times of the test
- the IP addresses the test will come from, IPv4 and IPv6
- the name of the testing company and a contact we can reach during the test
Allowing your tester through
If your tester needs their IP addresses allowed through our protections, see our article on allowing a scanner or tester’s IP addresses.
Consent forms and letters
If your client or auditor needs a signed form or letter from us, open a ticket with the document and our team will review it.