Scoping
Scope, environment, test payment methods, times to avoid.
OSCP Expert — Merchant Sites
A merchant site loses money in silence
On an e-commerce site, a vulnerability isn't seen in logs: it's seen in chargebacks, compromised customer accounts, and zero-euro orders.
- Checkout process: prices, quantities, promo codes, shipping costs
- Payment: provider returns, order status, refunds
- Customer accounts: password resets, access to others' orders
- Extensions and themes — the most common entry point on CMS
Request an e-commerce audit
Enter your store's URL. An expert will contact you to define the scope and schedule.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Included
re-test after correction
ALL OFFERS
Why audit
Cart fraud triggers no alerts
The vulnerabilities of a merchant site relate to business logic: nothing breaks, everything works, and the amount collected is not the one expected.
- A price or quantity modified client-side, an unforeseen combination of promo codes, bypassed shipping fees: the order goes through and payment is validated.
- A poorly verified payment provider's response allows an order to be marked as 'paid' without payment.
- Customer accounts contain addresses, order histories, and sometimes saved payment methods — this constitutes a personal data leak under GDPR.
- On a CMS, the majority of compromises occur through an obsolete extension, not the core software.
All engagements require written authorization and a defined scope.
Process
4 steps outside peak hours
Scoping, test accounts, controlled orders, and reporting.
Exposure
CMS version, extensions, themes, administration, backups, and files left online.
Purchase Journey
Complete test orders, from cart to payment confirmation, using multiple accounts.
Report and Retest
Corrections categorized by avoided loss, followed by verification.
Example report
What does a professional audit look like?
Anonymized example: executive summary, consolidated score, and priorities for your IT department or integrator.
- Executive summary and risk score on one page
- Prioritized findings with concrete remediation paths
- Internally shareable document (IT Dept, CISO, Management)
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
The human behind the tool
About your contact
I am a cybersecurity consultant: I support IT teams and management on audit, penetration testing, and hardening topics. Field-oriented background (SMEs, mid-sized companies, e-commerce, industry) with a simple requirement: actionable findings, not jargon.
Why this profession: making real risks visible to help make quick decisions — securing also means clarifying what matters for the business.
Expertise built since 2020 in various contexts; recognized certifications (OSCP, CISSP, OSEP) and continuous threat monitoring.
Pedagogy: translating technical details into business decisions (prioritization, budget, planning).
Frequently Asked Questions
What we answer before you ask
Will you place real orders?
Test orders, using the staging payment methods provided by your provider. No real transactions are initiated without your explicit consent.
Is this compatible with high traffic?
Yes: sensitive times — sales, commercial operations — are excluded during scoping, and the intensity of tests is adapted.
Do you cover PCI DSS compliance?
We audit the technical security of your store. PCI DSS certification is a separate process, managed by a qualified body; our report documents some of its prerequisites.
What if the site is already compromised?
We switch to incident response: searching for backdoors, cleaning, and service restoration. The audit follows, once the site is clean.
No commitment
Get your site audited audited
Enter your store's URL. An expert will contact you to define the scope and schedule.