Website Pentesting for E-Commerce: The Complete Guide
The scariest thing about your checkout page is not a flaw you know about. It is the flaw that shipped after your last pentest, being exploited while your report still says you passed. Security teams often learn about it from someone else, such as a card scheme, a regulator or a customer, long after the damage is done.
Website pentesting for e-commerce is penetration testing of your storefront to find the flaws an attacker could exploit before they do, starting with the checkout and payment flow, then login, account and API flows. The most effective approach today is continuous agentic pentesting, also known as AI pentesting: AI agents sign in and drive a real browser through those flows, test every endpoint against every applicable attack category, and validate each finding before it is reported. Reflectiz Offensive Hub does this on your schedule, with no code changes, and inside guardrails you define. Reflectiz invested heavily in scope control and audit trails so the agentic advantage never means free rein over your production site.
TL;DR
- The nightmare is the flaw you cannot see. Vulnerability exploitation starts 31% of breaches and is the number one initial-access vector (Verizon DBIR 2026). Mandiant’s M-Trends 2026 puts mean time-to-exploit at -7 days, so attackers now routinely exploit flaws before the patch ships, while the median organization takes 43 days to patch one. Reflectiz estimates an annual pentest covers around 10% of a web estate, and a store changes with every release.
- Checkout and payment come first. That is where a flaw turns straight into stolen card data, manipulated prices and fraud. Offensive Hub lets you set testing depth per flow, so the payment path gets the most.
- E-commerce flaws are mostly business logic. Broken access control, authentication and OTP bypass, price manipulation and cart tampering have no CVE, so scanners and DAST miss them.
- Agentic pentesting closes the gap. It tests on every release, a separate validator agent reproduces each finding, and every run leaves a coverage record. Reflectiz reports up to 10x the testing capacity at the cost of one manual engagement. That figure is about volume of testing, not a guarantee of more findings.
- Agents work inside guardrails. You define scope, exclusions, permitted attack techniques and off-peak windows, and name the steps that need admin approval. Reflectiz invested heavily in these controls so you get the agentic advantage without handing an agent free rein over production.
- It already works on live sites. Reflectiz’s agent found a critical OTP bypass on a major insurer’s production website. Separately, attackers breached seven South Korean banks and lenders, and CrowdStrike tied two of the attacks to ARTEX, an open-source agentic pentesting tool.
- Compliance benefits too. PCI DSS 11.4.3 requires external pentesting every 12 months and after significant change. Continuous testing produces the evidence for the second part.
Definition
What is agentic pentesting?
Agentic pentesting, also called AI pentesting, is penetration testing run by autonomous AI agents. They plan and run the individual steps, such as probing logins, trying requests and chaining findings, while a human sets the scope and reviews results. Unlike a manual test, it can repeat on every release.
What should an e-commerce website pentest cover?
An e-commerce pentest should start with the checkout and payment flow, then cover every other flow where a customer logs in or handles personal data, plus the APIs behind them. These are the areas where a flaw turns directly into stolen cards, account takeover or fraud, and most of them sit behind a login that basic scanners cannot reach.
| Priority | Area | Typical flaws | Why it matters for an online store |
|---|---|---|---|
| 1. Start here | Checkout and payment workflow | Price manipulation, cart tampering, workflow bypass, race conditions | Skipped payment steps, altered totals and fraud that no CVE describes, on the page where card data is entered |
| 2 | Login, MFA and one-time passcodes | Authentication bypass, MFA or OTP bypass, weak session validation | Account takeover and abuse of saved payment details |
| 3 | Customer accounts and orders | IDOR (insecure direct object reference), horizontal and vertical privilege escalation | Changing an ID in a request can expose another customer’s profile, orders or addresses |
| 4 | APIs behind the storefront | Broken authorization, missing rate limits, API-specific flaws | Bulk record extraction and automated enumeration |
| 5 | Injection and client-side code | XSS, including DOM-based XSS in logged-in flows | A confirmed injection on a checkout page carries the same blast radius as a hijacked vendor script |
| 6 | Data held in the browser | Secrets or API keys in local storage | Any script that runs on the page can read them |
The OWASP Top 10 is the usual baseline for this scope, and the flaw classes above map to its broken access control, authentication failure and insecure design categories. The IDOR class is not theoretical: it exposed 885 million mortgage and title records at First American Financial in 2019, where changing one digit in a document link showed someone else’s file.
Your first three moves
- Rank your flows. Put the checkout and payment path first, then login and account recovery, then customer accounts and the APIs behind them.
- Set the deepest testing level on the payment path and lighter checks on low-risk pages.
- Test on every release, not once a year, and keep the coverage record as audit evidence.
Why does the annual pentest fall short for e-commerce?
The annual pentest falls short because attackers often exploit flaws before a patch exists, defenders patch in weeks, and an online store changes with every release. A report written once a year describes a site that no longer exists by the time it is read.
| Metric | 2026 figure | Source |
|---|---|---|
| Breaches that start with vulnerability exploitation | 31%, the top initial-access vector | Verizon DBIR 2026 |
| Mean time to exploit a vulnerability | -7 days (exploited before the patch ships) | Google Mandiant, M-Trends 2026 |
| Median time to patch a known-exploited flaw | 43 days, up from 32 | Verizon DBIR 2026 |
| Known-exploited (CISA KEV) flaws actually patched | 26%, down from 38% | Verizon DBIR 2026 |
| Median time to resolve a high-risk pentest finding | 39 days | Cobalt, State of Pentesting 2026 |
| Web estate an annual pentest leaves untested | About 90% (estimate) | Reflectiz cost analysis |
Cost is part of the problem. A manual engagement averages about $18,300 before the common 30-50% overrun, and a mature program can spend $150,000 or more a year to test an estimated 5-10% of its assets (Reflectiz analysis of published vendor pricing). Against that, the average breach costs $4.99 million (IBM, 2026).
AI widens the gap from both sides. Attackers use it to find and weaponize flaws faster, and your own developers use it to ship code faster than a human team can test it. Continuous testing helps: teams with programmatic testing are 4.5 times more likely to fix critical findings within three days (Cobalt, 2026). AI pentesting that runs on every release is built for exactly this pace.
How do scanners, DAST, manual pentests and agentic pentests compare?
Only manual and agentic pentests can find business-logic flaws, and only the agentic kind re-checks them on every release. The clearest way to see this is one common attack chain in an online store.
An attacker logs into an ordinary customer account and changes the account ID on a profile-update request. The app never checks ownership. They enumerate IDs at scale, rewrite other customers’ email addresses, trigger password resets and take over the accounts. There is no CVE and no malformed input, only business logic the app got wrong.
| Approach | How it handles the chain | Outcome |
|---|---|---|
| Vulnerability scanner | Matches responses against a CVE database. No CVE exists for your app’s own logic | Missed |
| DAST | Fires a fixed list of payloads. The exploit needs a valid session and a multi-step sequence no payload list contains | Missed |
| Manual pentest | Finds it if this endpoint falls inside the sampled 5-10% of the estate, and only until the next release | Found once, then stale |
| Agentic pentest | Maps the endpoint, infers the ownership relationship and chains enumeration to email rewrite to password reset. The work item must clear on every run | Found and re-checked |
The category’s common failure is DAST with an LLM bolted on: the same fixed payload list underneath with unpredictable coverage layered on top. For a deeper look, read the CISO’s Expert Guide to Agentic Pentesting for Websites. The next sections show what separates a real platform from that.
What do real-world cases show about website pentesting?
Three recent cases show the same pattern: simple flaws in logged-in flows, found by agents, on live sites.
An AI agent found a critical OTP bypass on a live insurer site
During an authorized assessment, Reflectiz’s AI pentesting agent mapped the login flow of a major insurer’s production site and found that the login request chose where the one-time passcode went. The agent directed the code to an inbox it controlled, the code arrived and the login went through. Its guardrails halted the test after login, and Reflectiz reported the flaw. The insurer said it had pentested the site about six months earlier. Pentested is not the same as secure, because websites change with every release and pentest schedules do not. Read the full case study.
South Korea’s banks faced an agentic pentest from the attacker’s side
Between late September and early October 2026, attackers breached seven South Korean banks and lenders. CrowdStrike tied attacks on two unnamed banks to ARTEX, an open-source agentic pentesting tool, and which of the seven involved it is partly inference. The reported entry points were side doors: a lookup service for loan brokers, employee mobile apps and a sales-support system, protected by weak authentication and session checks. Banks needed 15 to 68 hours to detect the intrusions. The lesson for any online business is that attackers already run agentic pentests against your web apps, so yours should get there first. See the full analysis of the South Korean bank hacks.
Polymarket shows what a rogue script can reach
On October 29, 2026, a hijacked DebugBear script drained about $2.73 million from 737 Polymarket accounts in roughly an hour. The script read trading API keys from local storage, found the app’s own transaction signer in the page and moved funds seconds after each approval. Pentesting would not have stopped the hijack at the vendor’s registrar. It tests the first-party side, such as secrets in browser storage and a signer any script can reach, which sets how much a hijacked script can take. Read the full Polymarket breakdown.
How does Reflectiz run agentic pentesting?
Reflectiz Offensive Hub is a continuous agentic pentesting platform for web applications. It gives an e-commerce team provable coverage of logged-in flows on a schedule it controls. See it run in the Offensive Hub walkthrough or the on-demand webinar. Four design choices separate a real platform from a demo:
- Enforced coverage. The agent works from a full test matrix generated up front, every discovered endpoint against every applicable attack category, as work items it cannot skip. It is adaptive in how it attacks each item, never in whether it does. Each run leaves a coverage record of which tests ran, their outcomes and any exclusions.
- An independent validator. A separate agent reproduces each suspected finding with the same payload and context before it reaches your report. That removes false positives before they reach your triage queue.
- A browser-native agent. It drives a real browser through the flows a customer follows, including logins, one-time passcodes and 2FA, so it reaches the business logic behind the login page.
- Instant Baseline Advantage. Leverages intelligence from 100,000+ already analyzed web applications to accelerate recon, deepen coverage, and maximize ROI.
What you get
- Flaw classes: broken access control, IDOR, authentication and MFA bypass, injection (including DOM-based XSS), business-logic flaws such as price manipulation and cart tampering, and API flaws, across the OWASP Top 10.
- Depth per flow: four levels, from fast Scanner checks to Expert attack chains. Put the checkout and payment path at the top. The Senior level is built for flows like login, account areas and checkout, and Expert chains multiple attack paths on critical assets.
- Authenticated testing: for applications with a login, you provide the credentials. The agent keeps session context, follows login flows and handles one-time passcodes and 2FA when configured.
- Your cadence: on demand, weekly, monthly or continuously, with active hours scoped to off-peak windows. Run it against staging before a release or against production.
- Control: every run happens inside the guardrails described in the next section.
- Reports and workflow: formal PDF reports with reproduction steps, evidence and the full coverage matrix, plus a REST API, CI/CD triggers and Slack alerts.
- Faster fixes: Atlas, the AI remediation assistant, explains each finding in plain language and guides the fix.
An honest scope note: agentic pentesting does not replace MFA, rate limiting, bot defense or a SOC, and Offensive Hub does not block a live intrusion. Within the apps and roles you put in scope, it finds the open doors before someone else walks through them.
How do guardrails keep agentic pentesting safe on a live store?
Offensive Hub agents run only inside parameters you define. The advantage of agentic testing is autonomy, and autonomy is only acceptable when its worst case is bounded. That matters even more when the agent signs in with credentials you provide and works on a live checkout. The agent is adaptive in how it tests each item in scope, and it is never free to decide what it may touch.
- You define the scope. You choose which applications, domains, flows and endpoints are in scope, set explicit exclusions and name escalation points that need admin approval before the agent proceeds.
- You control the attack techniques. You decide which vectors the agent runs and which stay out of scope, so attack families too aggressive for your environment can be blocked while application-level tests go ahead.
- The system decides what gets tested, not the model. A test matrix of every endpoint against every applicable attack category is generated up front and enforced as non-skippable work items. The agent chooses how to execute each one, never whether to.
- Production-aware scheduling. Active hours can be limited to off-peak windows, and many teams run the agent against staging before a release.
- Authenticated, but external. You provide the credentials the agent tests with, so you choose the account and role. Reflectiz states that the agent works from the outside with no code insertion, no production infrastructure access and zero access to user PII or company data.
- Independent validation. A separate validator agent reproduces each finding before it reaches you, so nothing unverified lands in your report.
- Full audit trail. The coverage matrix records every endpoint, attack type, payload and result, and exports as a PDF report for your auditors. In the OTP bypass case, the guardrails halted the test right after login.
- Humans in control. Your team sets the scope, reviews the validated findings and decides what to fix. Atlas, the remediation assistant, supports that work and does not replace it.
These controls are part of what you are buying, not an add-on. A vendor that cannot show you its guardrails in a demo should not run an autonomous agent against your online store.
What does pentesting mean for PCI DSS and other compliance?
Compliance sets the floor at one pentest a year, and continuous testing is how you meet the “after significant change” part. PCI DSS 4.0.1 requirement 11.4.3 asks for external penetration testing at least every 12 months and after any significant upgrade or change. For an online store that ships often, a once-a-year report cannot show that each significant change was tested.
Continuous, documented testing produces that evidence. Every Reflectiz run creates its own evidence pack: a coverage matrix, validated findings with reproduction steps and trend reporting an auditor can query. The same records support control and assurance activities under DORA (which requires tests at least yearly on critical systems), NIS2, SOC 2, ISO 27001, GDPR Article 32 and HIPAA.
Confirm with your Qualified Security Assessor how it will treat agentic test evidence for your scope. Pentesting also does not cover the payment-page script requirements, 6.4.3 and 11.6.1, which are handled by script monitoring through the PCI Module (see below).
Where does pentesting end and third-party script monitoring begin?
Pentesting tests the code you control, and script monitoring watches the code you do not. An online store needs both, because a hijacked vendor script can bypass a perfectly tested checkout. Reflectiz covers each layer with its own product.
| Question | What answers it | Reflectiz product |
|---|---|---|
| Can an attacker break into my own login, account or checkout flows? | Agentic pentesting of first-party code | Offensive Hub |
| Did a third- or fourth-party script on my pages change or start behaving differently? | Agentless, continuous monitoring with behavioral baselines | Security Hub |
| Can I prove script authorization, inventory and change detection to a PCI auditor? | Compliance workflow for requirements 6.4.3 and 11.6.1 | PCI Module |
| Are pixels and trackers collecting personal data without consent? | Tracker and data-flow visibility | Privacy Hub |
Two customer stories show the monitoring side. A Magecart skimmer ran on Leeds United’s online store for six days before the UK’s National Cyber Security Centre spotted it. lastminute.com chose Reflectiz ahead of its first PCI DSS 4.0 audit, and its PCI auditor approved the tool without caveats. CSP, SRI and a WAF remain useful baseline layers, but they check where scripts load from or filter server traffic, not what a script does in a live session or how your own logic behaves. Learn more about Security Hub and its Magecart and web skimming protection, the PCI Module and Privacy Hub.
How do you choose an agentic pentesting vendor for your online store?
Choose the vendor that can prove its coverage and tell you the worst thing its agent can do to your production site and what stops it. An agentic pentest is both a security control and an autonomous AI system running against your own environment, so hold it to both bars.
- Provable coverage: Does it generate a full test matrix up front and report which tests ran, not just what it found?
- Independent validation: Does a separate agent reproduce every finding before it reaches your report?
- Real browser: Can it log in, handle one-time passcodes and 2FA, and test multi-step flows like checkout and account recovery?
- Business-logic depth: Does it test IDOR, privilege escalation, workflow bypass and race conditions, not only a payload list?
- Scoping and guardrails: Is scope explicit, with exclusions, admin-approval escalation points and control over which attack techniques are allowed?
- Data isolation: Does it work externally, with no code insertion and no access to your users’ PII or company data, and does it let you choose which credentials it tests with?
- Audit trail: Can you export a complete record of every action for your auditors?
- Cadence: Can you run it on every release, weekly or on demand, at a cost you can defend?
- Remediation: Does it explain each finding in plain language and guide the fix?
- Honest scope: Does the vendor say plainly what the tool does not do?
Ask for a demo on your toughest workflow, such as login, account recovery or checkout. Review how the agent navigates it, what evidence supports a finding, and how scope, guardrails and coverage are documented.
FAQs
Why do scanners and DAST miss flaws like IDOR?
Scanners match responses against known CVEs, and DAST fires a fixed list of payloads. An IDOR or OTP bypass is a flaw in your own business logic with no CVE, and exploiting it takes a valid session and a multi-step sequence.
Which pages should an e-commerce pentest test first?
Start with the checkout and payment flow, then login and account recovery, then customer accounts and the APIs behind them. Those are the pages where a flaw leads straight to stolen cards, account takeover or fraud. Offensive Hub lets you set a deeper testing level on those flows and lighter checks elsewhere.
What is website pentesting for e-commerce?
It is authorized, simulated attack testing of an online store’s login, account, checkout and API flows to find exploitable flaws before attackers do. The goal is validated findings with proof, so your team can fix what is real and ignore what is not.
What is agentic pentesting?
Agentic pentesting, also called AI pentesting, is penetration testing run by autonomous AI agents. They plan and run the individual steps, such as probing logins, trying requests and chaining findings, while a human sets the scope and reviews results. Unlike a manual test, it can repeat on every release.
Is it safe to run an AI pentesting agent on a production website?
Yes, when the agent works inside strict guardrails, which is why Reflectiz invested heavily in building them. Look for explicit scope with exclusions and admin-approval escalation points, control over which attack techniques are allowed, off-peak scheduling for production, an external-only architecture with no code insertion, and a full audit trail. In Reflectiz’s OTP case, the guardrails halted the test right after login.
Is a website secure if it was pentested recently?
Not necessarily. A pentest is a snapshot, and every release can introduce new flaws. Reflectiz’s agent found a critical OTP bypass on an insurer’s live site that had been pentested about six months earlier.
How often should an e-commerce site be pentested?
PCI DSS 4.0.1 sets the floor at once every 12 months and after any significant change. Because an online store changes with every release and attackers test continuously, many teams run agentic tests weekly, monthly or on each release.
Does agentic pentesting replace a manual pentest?
It changes the cadence and coverage rather than removing human judgment. Reflectiz reports up to 10x the testing capacity at the cost of one manual engagement, which describes volume of testing and not a guarantee of more vulnerabilities found. Ask in a demo how scope, depth and frequency affect cost for your applications.
Do I need anything installed to start?
No. Offensive Hub needs a URL and, if the application requires a login, authentication credentials. There is no code to install, no agent to deploy and no production infrastructure access, and most teams run their first test within one business day.
Can agentic pentesting test logins protected by OTP and 2FA?
Yes, if the agent drives a real browser. Reflectiz Offensive Hub follows login flows, keeps session context and handles one-time passcodes and 2FA when configured, so it can reach the flows behind the login page.
Subscribe to our newsletter
Stay updated with the latest news, articles, and insights from Reflectiz.
Related Articles
AI Has Changed The Web.
Are You Ready for What’s Next?
Third-party code shifts by the hour. Supply-chain compromises strike without warning. AI-driven web attacks now evolve faster than traditional security can ever keep up.
Reflectiz delivers the continuous, real-time visibility needed to expose the risks traditional tools miss entirely.
Zero code changes. Zero access to your data. Ultimate peace of mind.
