Consultation“How much does a web pentest cost?” has no precise answer without scope. A simple brochure site with one role is not comparable to a multi-tenant platform with payments.
Main price drivers: app/domain count, black-to-white depth, authenticated roles, API complexity, business-logic testing, and production versus staging windows.
Very cheap quotes are often automated scans with raw reports. Real value is manual analysis, controlled exploitation, and business priority. Low cost without retest often creates rework.
For better estimates, list assets, roles, environment, time limits, and expected outputs. Less ambiguity means a clearer proposal and faster negotiation.
Ask about retesting on day one: are Critical/High closures included? Without retest, you may remain with open findings and residual risk.
Compare price to risk: one access flaw on customer data can exceed an entire annual assessment budget. Security buying is a risk decision—not only an IT cost line.
Hoxy quotes fixed pricing after scope and avoids public fixed numbers because they mislead. For an estimate, send the consultation or pentest form with scope details.