Handoff Security / BUSINESS SECURITY
How much does website security testing cost in Hong Kong?
Compare Handoff Security starting prices and understand what changes a fixed quote.
What determines the quote?
The type of assessment, exposed services, workflows, user roles and API endpoints affect the work required. A short website can still have complex permissions. Page count alone is not a reliable measure of security testing effort.
Which service should I choose?
An external assessment checks exposed services and verifies important scanner results. Website and API security testing examines agreed application behaviour. Individual issue verification investigates one specified concern; it is not a full assessment.
What happens before testing?
We discuss suitability and agree scope before providing a fixed quote. Written authorisation and full payment are required before testing. Delivery dates are agreed in the quote; additional work is agreed separately.
Services & pricing
Website & API security testing
For custom portals before launch or updates.
From HK$7,800
Scope
1 app · Up to 2 workflows / 2 roles / 6 API endpoints
A workflow is a sequence such as completing a booking. A role is a type of user, such as a customer or administrator. We agree these with you and your website maintainer before quoting.
An API lets a website exchange data or perform actions with other systems. We confirm the actual API endpoints with your website maintainer; an endpoint is not the same as a website feature.
Test environments, test accounts and test data rather than real customer data are preferred.
All listed limits apply together. Agree the workflows, user types, information each user may see and test accounts before quoting. Checking whether users can see each other’s information requires separate accounts, even for the same user type.
Complex payments, separation of different companies’ data on one platform, uploads and connections to other services need separate scoping and a higher quote when they exceed the starting scope.
How the technical scope is counted
Each API endpoint counts as a combination of HTTP method and normalised path.
For example, GET /orders and POST /orders are different endpoints. Complex cases require scope review.
Included work
Within the agreed scope, targeted checks examine how the website verifies users signing in, what they can see and do, and how it handles information they submit.
OWASP publishes reference guidance for website security testing. We agree which checks to perform in writing; this service does not promise coverage of every item.
Deliverables
Test records, reproduction steps and evidence, verified impact, risk ratings and rationale, remediation advice and limitations.
Briefing & retesting
Includes one online walkthrough up to 30 minutes, and one retest of original findings within 30 days after the report, up to 2 hours. Extra work agreed separately.
Exclusions
- Code changes.
- Full source-code review.
- Denial-of-service testing (DoS), which attempts to make a service unavailable.
- Social engineering, which deceives people into providing information or access.
- Internal lateral movement, which involves moving into other internal systems after gaining access.
- Compliance certification.
External assessment
For public-facing systems.
From HK$4,800
Scope
1 external target
One agreed website address or public-facing system, with prior written permission.
Agree the IP address or full domain name, the services to check and the exclusions with your website maintainer.
The starting price depends on the agreed exposed services and verification effort; a host with numerous services requires separate scoping.
Included work
Automated vulnerability scanning with verification of important results.
Unverified items are labelled; scanner output is not automatically treated as confirmed vulnerabilities.
Deliverables
Scope, findings, verification status, risks, limitations and remediation advice.
Briefing & retesting
Includes one online walkthrough up to 20 minutes, and one retest of original findings within 30 days after the report, up to 1 hour. Extra work agreed separately.
Exclusions
- Excludes comprehensive testing after login, business-workflow logic testing, internal-network testing and a full web application penetration test.
- Other providers’ platforms and systems are not automatically included, including shared hosting and content delivery networks (CDNs), which distribute website content through multiple servers.
Individual issue verification
For a reported issue or fix.
From HK$1,200
Scope
1 specified issue · Up to 1 hour
Provide an existing report or usable steps that trigger the issue, written permission and ready test access. The hour limit covers hands-on verification.
Setup investigation, additional issues or work beyond the agreed limit require a new quote before continuing.
Deliverables
Short written reproduction / verification records and limitations.
Not triggering the problem again does not prove it is fixed.
Exclusions
- Excludes a new comprehensive assessment or reissuing the original provider’s compliance conclusion.
- Retests already included in External assessment or Website & API security testing are not charged again under this service.
Starting prices cover limited scopes. Scope confirmation precedes a fixed quote. Fees cover agreed work and deliverables, not findings; vulnerabilities and complete security are not guaranteed.
100% payment and written testing authorisation are required before testing begins. Before payment, the fixed quote sets out scope, deliverables, exclusions, fees, testing dates and expected delivery timing.
Let’s start with your website.
No technical knowledge needed.
Enquire about my websiteExclude passwords, tokens, customer data, private links and sensitive screenshots.