Skip to content
CyberLens AI

Security workflow guide

Free alternatives to a penetration test for small websites

Published by CyberLens AI. Last updated .

A professional penetration test starts at $5,000 and can reach $50,000 for a small web application. This guide walks through a practical five-step free workflow that closes the most common attack vectors when a full pentest is not an option.

The workflow covers an automated website scan, HTTP security header audit, dependency CVE check, git history secret scan, and an OWASP manual checklist for authentication, access control, and injection testing.

Run a free website scan Browse all guides

Step 1 — Automated website scan

CyberLens AI gives a security grade, visible findings, severity levels, and a prioritized fix list in under a minute. No signup required. Covers HTTPS posture, security headers, cookie flags, exposed metadata, and OWASP risk signals.

  • Run on the production URL, not localhost
  • Check the grade, findings list, and AI risk summary
  • Fix critical and high-severity findings first

Step 2 — HTTP security header audit

SecurityHeaders.com grades your response headers A–F. Target six headers before launch: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

  • Strict-Transport-Security: forces HTTPS for returning visitors
  • Content-Security-Policy: restricts what scripts and resources can load
  • X-Content-Type-Options: nosniff stops MIME-type confusion attacks

Step 3 — Dependency CVE audit

Run npm audit, pip-audit, or bundle-audit to check your supply chain against the NVD and OSV databases. Enable Dependabot on GitHub for continuous monitoring.

  • npm audit --audit-level=moderate for Node.js projects
  • pip-audit for Python projects
  • Enable Dependabot for automated fix PRs

Step 4 — Git history secret scan

Use gitleaks to scan every commit for accidentally committed credentials. Add it to CI so future secret commits fail the build.

  • gitleaks detect --source . --verbose scans full history
  • gitleaks protect --staged for pre-commit checks
  • Add gitleaks-action to GitHub Actions for automated enforcement

Step 5 — OWASP manual checklist

Automated tools miss logic bugs and access-control flaws. Spend 30–60 minutes on manual checks for authentication, broken access control, injection, sensitive data exposure, and CSRF.

  • Authentication: test wrong password, rate limiting, expired reset tokens
  • Access control: can you reach /admin or other users' resources without authorization?
  • Injection: do form fields and URL params sanitize user input?
  • CSRF: do state-changing requests require a CSRF token or SameSite cookie?

Questions and answers

Does this workflow replace a penetration test?

No. A penetration test is a manual engagement where a skilled tester chains findings, tests business logic, and looks for context-specific flaws that automated tools cannot find. This workflow is far better than nothing but does not provide the same assurance as a professional pentest.

When do I actually need a real penetration test?

If you handle payment card data (PCI-DSS), protected health information (HIPAA), or if an enterprise customer or insurance policy requires a SOC 2 Type II report, you will need a real penetration test. Also required if a breach would be existential for your business or if you store highly sensitive data at scale.

How much does a professional penetration test cost?

Scoped web application penetration tests start at $5,000–$15,000. Full application and infrastructure assessments range from $15,000 to $50,000 or more. Annual compliance engagements can exceed $100,000.

How often should I run these checks?

Before every major launch or deployment, and at minimum quarterly for active production sites. Run the dependency audit in CI on every pull request. Run the secret scan on every commit via a pre-commit hook.

Can CyberLens AI tell me my site is fully secure?

No scanner can certify that a site is fully secure. CyberLens AI gives a practical security grade, visible findings, severity context, and prioritized remediation steps — it is a tool to find and fix common risks, not a compliance certification.

Security references

CyberLens AI guidance is informed by established security standards and public vulnerability intelligence.