What a website pentest costs and what moves the quote

A pentest price is frightening when it is quoted "from-to" with a tenfold spread and no explanation. Our honest guide is simple: from $50 per endpoint. An endpoint is a separate application or a clearly separate perimeter, not every button on the site. A landing and a store with an account area and an API are not the same endpoint.

What increases the work

• Several roles: guest, customer, manager, administrator. Each must be checked against other people's data.
• A separate API, a mobile app or an account area on another domain.
• Payment, bonus points, a price change, report export. That is business logic. A scanner does not take it.
• A retest after fixes. It belongs in normal work, not in a "premium" tier.

What should not inflate the price

The page count of the PDF, a pretty dashboard and a promise of "full OWASP coverage" without an address list. A typical site takes 1-3 weeks, because findings are confirmed by hand and written so a developer can close them. We quote after a short description of the scope, not from the company name.

If the budget is still for one look at the state, start with an audit: the basic site audit is free for new clients. It often shows that a pentest is needed not for everything, but for the account area and the API. That is how Lexora counts: boundaries first, then the price, then the work. We do not hide a load test of production inside that sum. It is separate, and only in a window you set.