Penetration Testing for E-commerce Websites in the UK

Why E-commerce Sites Are High-Priority Targets

An e-commerce website combines three things attackers want: payment data, personal data, and a mechanism for financial transactions. The combination makes online shops a consistently attractive target across every sector and at every business size.

The threat landscape facing e-commerce operators in the UK includes card skimming attacks (malicious JavaScript injected into checkout pages that captures card details as they are typed), account takeover targeting stored payment methods and loyalty points, order manipulation to obtain goods at reduced or zero cost, and data theft targeting customer records for use in identity fraud and social engineering.

UK e-commerce businesses that accept card payments are subject to the Payment Card Industry Data Security Standard (PCI DSS). Version 4.0, which became mandatory in March 2025, includes penetration testing as a specific requirement for merchants depending on their compliance level. Beyond PCI DSS, UK GDPR applies to the customer personal data that any online shop collects.

What a Penetration Test Covers for an E-commerce Site

A penetration test for an e-commerce website examines the full attack surface from the perspective of an external attacker. The scope for a typical online shop includes:

**Customer-facing application** — The product catalogue, search, basket, checkout, and account management flows are examined for injection vulnerabilities, broken access controls, and business logic weaknesses. A penetration tester does not just look for SQL injection and XSS — they trace the logic of your ordering system to find ways to manipulate prices, quantities, discount codes, or fulfilment.

**Authentication and account security** — Login pages are tested for rate limiting and account lockout. Password reset flows are examined for vulnerabilities that could allow account takeover. Stored payment method and saved address functionality is tested for access control weaknesses.

**Payment integration** — Where the checkout is integrated with Stripe, PayPal, Worldpay, or another payment provider, the integration is examined. Common weaknesses include client-side price manipulation (where the order amount is set by the front end and can be modified before submission), insecure webhook handling (where payment confirmation webhooks lack signature validation), and redirect flows that can be manipulated to mark orders as paid without completing payment.

**Admin and back-end panels** — Shopify merchants have a Shopify-managed admin; WooCommerce, Magento, and custom platforms have their own. Admin panels are tested for authentication strength, access control between staff roles, and exposure of sensitive data or functionality.

**API endpoints** — Modern e-commerce platforms expose APIs consumed by mobile apps or headless front ends. These APIs are tested for the same vulnerabilities as the web application, with particular attention to endpoints that expose customer data or allow order modification.

**Infrastructure and configuration** — Server configuration, SSL and TLS settings, HTTP security headers, and exposure of development or staging environments are assessed.

Business Logic Vulnerabilities in E-commerce

Business logic vulnerabilities are weaknesses specific to how your application implements its rules, rather than generic web application issues. They are particularly prevalent and impactful in e-commerce contexts:

**Price manipulation** — An attacker modifies the price field in a request before checkout completes. This is most common in custom checkout implementations where the price is passed from the front end. Secure implementations always calculate the final price server-side at the point of order creation, using the product catalogue as the source of truth.

**Discount code abuse** — Single-use codes applied multiple times, percentage discounts applied incorrectly to gift vouchers, discount stacking that exceeds 100% of order value, or codes that should be account-specific working for any account.

**Negative quantity or negative price items** — Where the basket implementation fails to validate that quantities are positive integers, adding a negative quantity of an item can produce a negative line total that reduces the overall order value.

**Order status manipulation** — Direct access to order management endpoints without proper authorisation checks, allowing a customer to mark their own order as fulfilled or to access other customers' orders.

**Loyalty point and credit manipulation** — Where a platform implements a loyalty scheme or store credit system, the logic for earning and spending points is tested for manipulation opportunities.

PCI DSS 4.0 and Penetration Testing Requirements

PCI DSS Requirement 11.4 mandates penetration testing for in-scope systems. The requirements include:

- External penetration testing at least annually and after significant infrastructure or application changes - Internal penetration testing at least annually - Coverage of the entire CDE (cardholder data environment) perimeter - Testing at the network and application layer - Testing to verify that segmentation controls are effective where segmentation is used to reduce PCI scope

The penetration test must be performed by a qualified internal resource or a qualified external third party. The results, including remediation of exploitable vulnerabilities, must be documented.

For merchants processing fewer than 20,000 Visa or Mastercard e-commerce transactions annually (SAQ A and SAQ A-EP merchants), the requirements differ — but the spirit of regular security assessment applies regardless of compliance tier.

Frequency and Timing

A penetration test should be conducted at least annually. Additional tests should be triggered by:

- A significant change to the application — a new checkout provider, a redesigned account management flow, a new API endpoint - A security incident or suspected breach - A major platform upgrade (for example, migrating from WooCommerce to Magento)

For e-commerce businesses trading continuously, the operational impact of a breach — chargebacks, card scheme fines, loss of payment processing capability, regulatory fines, and reputational damage — makes annual testing a straightforward cost-benefit decision. [Cyber insurance for UK businesses](/blog/cyber-insurance-uk-security-requirements) typically requires evidence of security assessment and may reduce premiums where regular testing is documented.

For a detailed walkthrough of e-commerce checkout security specifically — including payment provider integration weaknesses — see the [e-commerce checkout security guide](/blog/ecommerce-checkout-security-uk). And if you're evaluating whether automated scanning could substitute for a manual test in some areas, [automated vs manual penetration testing](/blog/automated-vs-manual-penetration-testing-uk) covers where each approach works and where it falls short.

Yrzo AI's automated security assessment covers 54 checks across your e-commerce website's attack surface, including checkout security, authentication controls, HTTP security headers, and common web application vulnerabilities. Results are delivered in minutes. For ongoing assurance, the monitoring plan rescans daily and alerts you to new findings as they emerge. From yrzoai.dev.