Skip to content
Shahid Malla

Security Testing and Audits

Website and Web App Penetration Test

A manual, authorized security test of your website or web app, with severity ratings, proof, fix steps and a retest.

Shahid Malla

Shahid Malla · Top Rated on Fiverr and Upwork
600+ Fiverr reviews, 4.9 average · 13+ years · 900+ projects

OWASP Top 10OWASP ASVSCVSS

About this package

This is a website penetration testing service for small businesses, hosting companies and SaaS founders: I test your site or web app the way an attacker would, inside a scope you sign, and hand you a written report with CVSS severity, proof and fix steps, followed by a retest. It covers logins, forms, account areas and admin panels, not just an automated scan.

Before the first request

The system owner signs a written authorization, and you and I agree the scope: domains, user roles, test accounts, dates and the hours testing may run. Every target has to be yours or under your control. If the site runs on shared hosting or on a platform such as Shopify or Webflow, that provider's testing policy applies too, and some ask for notice first. I prefer a staging copy; when production is the only option, requests are throttled and timed to your quiet hours.

What gets tested

  • The OWASP Top 10 on every plan, with selected OWASP ASVS Level 2 requirements on Premium.
  • Access control with separate accounts, so I can see whether one customer can open another customer's orders, files or invoices.
  • Password reset, session expiry, file upload and the flows where money or personal data changes hands.

Each finding in the report shows the request or screenshot that proves it and the change that closes it, ranked so your developer fixes the worst first.

Matching the plan to the app

Starter suits a business site or small store with one login. Business is for a web app with customer accounts and an admin role. Premium is for a SaaS product with several roles, invites, billing and tenant separation, and adds a call to walk your developer through the report.

Lines I do not cross

No denial-of-service or load testing, no phishing or social engineering, and nothing outside the signed scope. I never copy live customer data as proof. The report goes to you alone, under your NDA if you want one. It can support your PCI DSS or SOC 2 work, though your assessor decides compliance, and no test can promise a site will never be breached.

Compare packages

Package Starter$449 Business$1,099 Premium$2,499
User roles tested 1Up to 2Up to 4
Retests 1 within 30 days1 within 45 days2 within 60 days
OWASP Top 10 checks
CVSS severity and fix steps
Cross-account access tests –
Business logic checks –
Summary for owners –
OWASP ASVS Level 2 checks ––
Report walkthrough call ––
Delivery time 5 days9 days15 days
Revisions 223

What I need from you

After you pay, a project opens for your order. Send these there and the delivery clock starts.

  • Signed authorization from the system owner and the agreed scope
  • Target URLs, and whether staging or production is in scope
  • Two test accounts per user role, holding no real customer data
  • Your hosting provider or platform, so its testing policy can be checked
  • A technical contact and the hours testing is allowed

About the developer

Shahid Malla

Shahid Malla

AI agent and AI chat developer, full-stack developer

Top Rated on Fiverr and Upwork

Based in
Kashmir, India
Experience
13+ years
Projects
900+ delivered
Languages
English, Hindi

I have built websites, WHMCS modules and web apps for clients since before AI coding tools existed. Today I build with AI-assisted tools and review every change myself, which is why fixed prices here are lower than an agency's for the same scope. I work while the US, Canada and Australia sleep, so each morning there is progress on your staging link.

Read my 600+ Fiverr reviews · Upwork profile · Portfolio · About me

Questions about this package

Will you test our live site or a copy?

A staging copy that matches production is my first choice, because I can test aggressive inputs without touching real orders. If you only have production, I test it with low request rates, in hours you pick, using test accounts only, and I skip actions that would email real customers or charge real cards.

Is a vulnerability scanner report the same as this?

No. A scanner finds missing headers and known software versions well, but it cannot tell that customer A can read customer B's invoice by changing a number in the URL. I use scanners for coverage, then test logins, roles and business flows by hand, and I remove scanner noise that does not apply to your app.

What happens if you find something critical mid-test?

I tell your technical contact the same day instead of waiting for the report, with enough detail to start a fix. If the finding exposes data or puts the system at risk, I pause that line of testing until you decide how to proceed, and it still appears in the final report.

How ordering a package works

  1. 1

    Choose a plan

    Pick Starter, Business or Premium and pay once by card, PayPal or crypto. The price on the page is the price.

  2. 2

    Send your content

    A project opens for your order. Send your text, logo, photos and any logins I need there.

  3. 3

    I build it

    I build on a private staging link you can open on your phone, with updates as I go.

  4. 4

    Launch and handover

    After your approval the site goes live on your domain, and every login is yours.

One-time price, no monthly fee from me

You pay for the build once. Your domain and hosting are registered in your name and renewed with your hosting provider, who bills you directly. I add nothing on top, and the site keeps running whether or not you hire me again.

What I do not build

Gambling and adult websites, and sites that sell content without the rights to it. Need something not listed? Ask for a custom quote.

More security testing and audits

All security testing and audits · All package categories