How often should you have your website penetration tested?

A penetration test reflects your website as it is at the moment it is carried out. Because sites change and new vulnerabilities keep appearing, it is best treated as a recurring check rather than a one-off.

As a general guide, consider a test:

• Periodically as routine assurance — especially for a site handling logins, payments or personal data.
• After significant changes — a redesign, new features, a platform upgrade or a batch of new plugins, any of which can introduce fresh weaknesses.
• After remediation, to confirm the previous findings are genuinely closed.
• If you have any reason for concern about the security of the site.

Between tests, keeping your CMS, plugins and components up to date does much of the work of staying safe. The test is what tells you whether the site as a whole is actually holding up against someone trying to break in.