Which requirement are you facing?
Three ways Shopify asks about security.
Pick yours. The pentest shifts a little for each.
Certified Technology Partner.
Annual independent pentest. OWASP and NIST. Not optional, not self-assessed.
Protected customer data, Level 2.
Names, emails, addresses, phones. Seven extra controls to prove. A pentest is how you prove them.
App Store review or delisting notice.
Missing CSP. Unverified webhooks. OAuth after the UI. Small misses, long delays.
What Shopify asks vs how Astra maps
18 controls. We'll tell you
which ones a pentest can
prove.
Not all of them, for the record. Six are your internal process, and the report says so.
Shopify-specific test cases
Test cases that speak Shopify.
OWASP Top 10, plus the eight places Shopify apps actually break.
OAuth and session tokens
OAuth before any UI. Tokens checked server-side.
Webhook HMAC (401)
Invalid signature? Expect a 401, every time.
frame-ancestors CSP
Your admin, frameable only by the shop.
Scope over-reach
Every API scope earns its place.
Multi-tenant shop isolation
Shop A never sees Shop B. We try every route.
App proxy and theme extensions
No injection through the storefront.
Billing tampering
No paid features without an active charge.
Token storage
Offline tokens encrypted. Never in logs.
How it works
Certificate in days. Not quarters.
Pricing
Pricing, without the sales maze.
Offensive DAST vulnerability scanner that scans behind login for 15,000+
test cases like OWASP Top 10, ports, CVEs & more
$69/m
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
.svg)
$199/m
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$499/m
Target
You get 5 target slots, with the ability to change targets in those slots with a 30-day cooling period. Example: Scan 5 targets, after 30 days scan 5 new targets.
Target Explained: Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, website, API etc. If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$699/yr
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$1999/yr
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$4999/yr
Target
You get 5 target slots, with the ability to change targets in those slots with a 30-day cooling period. Example: Scan 5 targets, after 30 days scan 5 new targets.
Target Explained: Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, website, API etc. If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
Hacker-style pentest by Autonomous AI & certified experts at dev speed, built to meet & exceed
SOC2, ISO, & HIPAA requirement
One web or SaaS app counts as one target, including all APIs consumed.
Mobile is per platform, so an Android app and an iOS app are two targets
Networks, cloud, IPs and standalone APIs are 1 target each
$2999/yr
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
One web or SaaS app counts as one target, including all APIs consumed.
Mobile is per platform, so an Android app and an iOS app are two targets
Networks, cloud, IPs and standalone APIs are 1 target each
$5999/yr
$9999/yr onwards
$999/yr
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Know More
Weekly vulnerability scans with 3000+ tests (OWASP, SANS etc.)
Essential features like pentest dashboard, PDF reports and scan behind login
Continuously discover & scan every API in your infrastructure for broken access control, authorization flaws, OWASP Top 10 & more
$199/m
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
$1999/yr
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
Astra continuously scans AWS, Azure, and GCP for misconfigs, IAM risks, and vulnerabilities, validating every finding before it reaches you
$99/m
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
$999/yr
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
Frequently asked questions
What is included in Astra’s Web App Pentesting Services?
How long does a typical web application penetration test take?
What types of vulnerabilities are identified during a web application pentest?
How does the pricing work?
I have a specific scope, can you tailor the pricing?
Do you test APIs?
Which engagement options do you offer for black-box, grey-box, and white-box testing?
Keep reading.
PHP2Shell: Two Critical PHP Vulnerabilities, How They Work, and What to Do About Them
Explore the guide