A penetration test is time-boxed. Every hour a tester spends documenting an obvious, easy-to-fix issue is an hour not spent on the deeper problems you actually need found.
You don’t need to be “secure” before a test. That is what the test is for. But a few basic fixes beforehand mean the report focuses on real risk instead of low-hanging fruit you could have closed in an afternoon.
Here are five worth doing.
1. Add basic security headers
Missing security headers are among the first things any tester notices. They are rarely the most serious finding, but they add noise to a report and are easy to fix.
At a minimum, look at:
- Strict-Transport-Security, so browsers only connect over HTTPS
- Content-Security-Policy, to limit where scripts can load from
- X-Content-Type-Options: nosniff
- X-Frame-Options or a CSP
frame-ancestorsrule, to prevent clickjacking - Referrer-Policy, to avoid leaking URLs to other sites
Our free Security Headers Builder generates ready-to-paste configuration for Nginx, Apache, Cloudflare, Netlify and Vercel. Start with a report-only CSP if you are worried about breaking things.
2. Remove secrets from code and the front end
API keys, database passwords and cloud credentials have a way of ending up in places they shouldn’t: committed to a repository, bundled into JavaScript, or left in a mobile app.
Before the test:
- search your repositories for keys and tokens, including old commits
- check what your front-end bundle and mobile builds actually contain
- rotate anything you find, rather than only deleting it
A leaked key found during a test is a finding. A leaked key found by someone else is an incident.
3. Turn off debug output and verbose errors
Stack traces, framework debug pages and detailed error messages tell an attacker which technologies you use, where your files live and sometimes what your database queries look like.
Make sure production and your test environment return generic error messages, and log the details on the server instead. Disable debug modes, admin consoles and sample pages that ship with frameworks and servers.
4. Update the obvious outdated components
Known vulnerable libraries and server software are easy for testers to spot and easy for you to fix. Run your dependency tooling (npm audit, pip-audit, Dependabot or similar) and patch anything with a known critical or high issue.
You won’t get everything, and that is fine. The goal is to clear the well-known problems so the tester spends their time on your application logic, authorization and business rules, which tools cannot check for you.
5. Prepare test accounts and access properly
This one isn’t a security fix, but it has the biggest effect on the value of your test.
Testers need accounts for every role in your application, and ideally accounts in two separate tenants if you are a multi-customer platform. Without them, they cannot test whether one user can reach another user’s data, which is often where the most serious issues are.
Before kickoff, check that:
- every account can sign in, including any MFA setup
- each role has realistic data to work with
- API documentation or a Postman/OpenAPI collection is ready
- any IP allow-listing for the testers’ address is in place
- someone technical is available to answer questions during testing
Missing access on day one can easily cost a day of testing time.
What not to do
Don’t try to fix everything before the test, and don’t delay the test chasing perfection. Don’t hide known weaknesses from your testers, either. Telling them about areas you are worried about helps them focus.
And don’t switch off security controls just for the test. If your WAF blocks a tester, that is useful information. If you want the application itself tested behind it, agree an allow-list for the testers’ IP address instead.
Where to start
If you are not sure how ready you are, our free SOC 2 Pentest Readiness Checklist walks through the main preparation steps and gives you a prioritised list of gaps. Our how we work page explains what we ask for before testing begins.
Planning your first test? Get in touch and we’ll help you scope it.