Penetration Testing for Letting Agencies in the UK

The Data Letting Agencies Hold

A letting agency accumulates a significant volume of sensitive data in the ordinary course of business. Tenant referencing alone typically involves collecting full names, dates of birth, current and previous addresses, employment details, salary information, bank statements, and copies of passports or driving licences. Landlord records hold bank account details for rental payment transfers, property ownership information, and in some cases mortgage details.

This data sits in a combination of places: your website's contact and application forms, a property management software platform, email inboxes, and sometimes shared drives. The website is the outward-facing layer — and the entry point an attacker is most likely to probe first.

UK letting agencies are subject to UK GDPR, the Data Protection Act 2018, and depending on their activities, obligations under the Money Laundering Regulations 2017 if they handle client money. A breach resulting in exposed tenant passport data or landlord bank account details carries real ICO enforcement risk.

What a Penetration Test Covers for a Letting Agency

A penetration test for a letting agency website examines the attack surface that an external threat actor would see. The scope typically includes:

**Tenant application and referencing forms** — These forms collect the most sensitive information on any letting agency website. A penetration tester checks whether form inputs are validated and sanitised, whether submitted data is transmitted securely, and whether the back end that receives the data is accessible only to authorised staff.

**Landlord and tenant login portals** — Where the agency provides an online portal for landlords to view statements or tenants to submit maintenance requests, the tester checks authentication controls, session management, and whether one user can access another's records. Insecure direct object references — where changing an ID in a URL exposes another person's data — are a common finding in property portals built without proper authorisation checks.

**File upload and document storage** — Referencing processes often involve document uploads. A tester checks whether uploaded files are validated by type and content, stored securely, and accessible only to those with a legitimate need.

**Third-party integrations** — Rightmove and Zoopla feeds, property management platforms, payment processors for deposit handling, and live chat tools all represent integration points. Each one is a potential weakness if the integration is misconfigured.

**Email security configuration** — DMARC, DKIM, and SPF records are checked to assess whether your domain can be spoofed in phishing emails targeting landlords or tenants.

Common Findings in Letting Agency Assessments

Unprotected document downloads

Tenant application documents are sometimes stored in web-accessible folders with predictable filenames. An attacker who discovers the naming pattern — for example, `/uploads/application-2024-001.pdf` — can iterate through document IDs and download passport scans and bank statements without authenticating. A penetration test identifies this configuration before an attacker does.

Missing account lockout on portals

Landlord and tenant portals without brute-force protection are vulnerable to credential stuffing. An attacker with a list of email addresses sourced from a previous breach can test common passwords systematically until they gain access to an account. Account lockout, rate limiting, and multi-factor authentication close this gap.

Cross-site scripting in maintenance request forms

Tenant maintenance request forms often accept free text. If that text is rendered in the agency's internal admin interface without sanitisation, an attacker can submit a payload that executes code in the browser of any staff member who views the request. The impact ranges from session token theft to credential harvesting.

Insecure API endpoints behind the portal

Modern property portals often expose JSON APIs consumed by the front end. These APIs are sometimes less carefully protected than the web interface. A penetration tester makes direct HTTP requests to the API to check whether authentication is enforced and whether responses leak data about other clients.

Regulation and Compliance

The ICO's guidance on data protection by design and default applies directly to letting agencies collecting tenant and landlord data. Where an agency uses a client money protection scheme, the scheme's terms will typically require reasonable technical controls. The Propertymark Code of Practice for Residential Letting Agents references data protection compliance as an ongoing obligation.

An annual penetration test provides documented evidence of security assessment — useful both for compliance purposes and in the event of a regulatory enquiry following a breach.

How Yrzo AI Fits

If you want to understand how a full penetration test differs from an automated scan, [automated vs manual penetration testing](/blog/automated-vs-manual-penetration-testing-uk) covers when each approach is appropriate and what each one actually checks.

An automated web security assessment from Yrzo AI covers the technical attack surface of your letting agency website: form security, authentication weaknesses, server configuration, SSL and TLS, HTTP security headers, and common web application vulnerabilities across 54 automated checks. Results are available within minutes, with findings explained in plain language and specific remediation steps for each issue.

For agencies that want continuous assurance rather than a point-in-time assessment, Yrzo AI's monitoring plan rescans your site daily and emails you immediately if a new vulnerability is detected. Pricing starts at yrzoai.dev.