Optimizely CMS Penetration Testing
Optimizely CMS has no hidden admin URL, so group permissions and virtual roles are the entire access control layer. We test whether those permissions hold on the admin UI and the API. CREST-certified testers, fixed price from £3,380 for a 3-day single-instance scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Optimizely’s own documentation confirms the edit and admin interface sits here by default, and that CMS does not rely on hiding this path to protect it. Access rights and virtual roles are what actually decide what a request to it can do.
Why Optimizely CMS security depends on access rights and virtual roles, not a hidden URL
Optimizely CMS decides what a user can do through two layers working together: access rights assigned per group across the content tree, and virtual roles, an extension of the role concept where membership is worked out at runtime rather than stored against the account. Optimizely’s own virtual roles documentation lists Anonymous, Everyone, Authenticated, Creator, CmsAdmins, CmsEditors, SearchAdmins and SearchEditors as the roles shipped by default, and a custom one registered in code reaches every request evaluated against it, not the users you added by hand one at a time. We test whether the groups and virtual roles your editors and integrations actually run under match what each part of the content tree, and each custom permission, is supposed to allow.
The edit and admin interfaces sit at a predictable location, yourserverhost.com/EPiServer/CMS by default, a path that still carries the CMS’s earlier product name, Episerver, in its default URL and its .NET namespaces. Optimizely’s security documentation is direct that the platform does not rely on a secret URL to protect these views: the authorisation policy behind the path is the actual control, whether that path is moved or not. Custom controllers carry the same logic further, protected with the AuthorizePermission attribute against permission types you define, and content itself only renders a preview once a content type has a template with its own controller and view. We test the authorisation behind your edit and admin views, your custom .NET controllers and blocks, and which content versions are reachable before they clear approval.
Where Optimizely exposes content beyond the CMS itself, the same permission logic applies. A single key against Optimizely Graph returns only published content that is not deleted, has not passed its StopPublish date, and carries read access for the Everyone group, while Bearer, HMAC and Basic authentication grant restricted or full administrative access instead; the Content Delivery API exposes the same content and Commerce Connect data through REST endpoints under /api/episerver/. On Optimizely DXP specifically, Optimizely’s own DXP security documentation sets out a shared responsibility model where Optimizely, Microsoft and Cloudflare patch the platform while you remain responsible for custom code, configuration and correctly configured roles and permissions. We test whichever surface, DXP or self-hosted, your instance actually exposes.
SCOPE
What we pen test on an Optimizely CMS instance
Content Tree Access Rights and Groups
Optimizely’s own configuration guide is explicit that assigning a user to a group is only half the job: you then define what that user can do and where in the content structure, through access rights set per group. WebAdmins and WebEditors are the platform’s own groups for the CMS admin and edit views, and have to be added from the admin view before they take effect. We test whether the access rights your groups actually hold match what each part of the content tree is meant to allow.
Virtual Roles and Runtime Membership
Optimizely CMS extends the role concept with virtual roles, groups such as Anonymous, Everyone, Authenticated, Creator, CmsAdmins, CmsEditors, SearchAdmins and SearchEditors, whose membership is worked out at runtime rather than stored against the user. A virtual role can also be registered in code and exposed as a permission, so a rule that is too broad reaches every request evaluated against it. We test what your virtual roles actually grant, not just the static groups shown in the admin view.
Edit and Admin UI at /EPiServer
Optimizely sets up its edit and admin views, by default, at yourserverhost.com/EPiServer/CMS, and the root path can be moved with ProtectedModuleOptions and UIOptions, though the CMS, Shell and Commerce module names underneath it cannot be renamed. Optimizely’s own security documentation states plainly that CMS does not rely on a secret URL to protect these views, so moving the path is obfuscation, not the control. We test whether the actual authorisation policy behind the edit and admin views holds, whatever path they sit on.
Decoupled Deployment and UI Isolation
For solutions with physically separated servers, Optimizely’s own guidance recommends a dedicated, internally protected server for the edit and admin interfaces, with the public-facing application blocking edit and admin access entirely by overriding the CmsPolicyNames.CmsEdit and CmsPolicyNames.CmsAdmin authorisation policies. Self-hosted .NET deployments that skip this separation carry the whole burden of the same access rights and virtual roles doing the isolating instead. We test whether your public-facing application can actually reach edit or admin functionality, decoupled or not.
Content Versions, Approval States and Preview
Content in Optimizely CMS moves through version states, CheckedOut, AwaitingApproval, Rejected, CheckedIn and Published, and its StartPublish and StopPublish properties control when a version is actually live; approving or rejecting a version checks whether the user is a member of the role the approval step requires. Preview only renders where a content type has a template with its own controller and view. We test whether a version that has not cleared its approval step, or a preview render, is reachable by an account that should not see it yet.
Custom Controllers, Blocks and .NET Code
Optimizely’s Permissions to functions system lets you protect a custom MVC controller with the AuthorizePermission attribute, checked against permission types you define in code and assign to users or roles in the admin interface. A permission can also be exposed as a virtual role for systems that can only validate roles, so a mistake in that mapping reaches further than the single controller it was written for. We test your custom controllers, blocks and APIs against the permissions they claim to enforce, not the Optimizely platform underneath them.
Content Delivery API Exposure
The Content Delivery API is Optimizely’s unified, headless API for CMS and Commerce Connect content, exposed under endpoints such as /api/episerver/*/content, /site and /search/content, and it also renders Optimizely Forms for single-page front ends. We test what an unauthenticated or low-privileged caller can retrieve through these endpoints, since the API only ever returns what the requesting account’s access rights allow, and that boundary is what we are checking.
Content Graph Query Access and Keys
Optimizely Graph’s single key authentication gives read-only access to published content at the GraphQL endpoint, and Optimizely’s own documentation defines exactly what that includes: content that is not deleted, whose StopPublish is either unset or still in the future, that is in Published status, and that carries RBAC read access for the Everyone group. Bearer, HMAC and Basic authentication instead grant restricted or full administrative access scoped by identity and role. We test what your single key actually exposes against that definition, and whether any restricted or admin credential is reachable from outside its intended use.
Authentication Integrations: OpenID Connect and Entra ID
Optimizely integrates with Entra ID through the ASP.NET OpenID Connect middleware, syncing signed-in users and their group membership into Optimizely through the OnSignedIn event and ISynchronizingUserService. Optimizely’s own documentation notes that you can replace virtual roles entirely with application roles defined in the Entra ID manifest, delegating that control from the application to Azure. We test whether the claims and group membership your integration actually receives match the access rights and virtual roles they are meant to drive.
DXP (Cloud) vs Self-Hosted
Optimizely DXP extends CMS with commerce, personalisation and marketing automation on Azure, and its published shared-responsibility model has Optimizely, Microsoft and Cloudflare patching platform and infrastructure vulnerabilities while you remain responsible for custom code, configuration, and configuring roles, permissions, MFA and SSO correctly. Self-hosted deployments carry that whole responsibility themselves, including the admin URL and server isolation covered elsewhere in this scope. We test whichever model your instance actually runs, against the access rights, virtual roles and API keys it depends on.
OUR PROCESS
Optimizely CMS Penetration Testing: From Scope to Attestation
Scope and Access
We agree whether your instance runs on Optimizely DXP or self-hosted, the editor and admin accounts we need for each group, and whether custom .NET controllers, blocks, the Content Delivery API or Content Graph are in scope.
Permission and Role Mapping
We map your access rights across the content tree, your virtual roles, and any Entra ID or OpenID Connect integration against what each group is actually meant to reach.
Manual Testing
A CREST-certified tester manually tests the edit and admin UI, Content Delivery API and Content Graph queries, custom controllers and blocks, and unpublished or pre-approval content, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Optimizely pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Optimizely CMS Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Optimizely For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Optimizely CMS Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Optimizely CMS?
An editor account in a relevant group, such as WebEditors, and where possible an account for each virtual role you run in production, including Anonymous, Everyone, Authenticated and any custom roles. Read access to your access rights configuration speeds up coverage but is not required for black-box testing.
Will testing touch our live data?
We test whichever environment you give us, and where that is production we agree exclusions in advance, such as bulk publish or unpublish actions, workflow emails, and any Commerce Connect checkout or payment flow. Read-only checks against published content are logged as they happen.
How long does an Optimizely CMS penetration test take?
A single-instance engagement sits in our 3-day scope, with a report typically landing around 5 working days after kickoff. More groups and virtual roles, additional Content Delivery API or Content Graph integrations, or a larger custom codebase move into a larger engagement with more testing days.
Do you test Optimizely DXP and self-hosted the same way?
The testing goals are the same, what a request can actually reach given your access rights, virtual roles and API keys, but the detail changes. On DXP, Optimizely’s shared responsibility model has Optimizely, Microsoft and Cloudflare patching the platform and Azure infrastructure while you remain responsible for custom code and correctly configured roles and permissions. Self-hosted deployments carry the admin URL isolation and server configuration themselves.
What is out of scope for a single-instance Optimizely CMS test?
The underlying CMS platform codebase, and on DXP the Azure infrastructure, CDN and Web Application Firewall that Optimizely and Microsoft operate directly. A separate Commerce Connect deployment or DAM integration beyond the CMS instance itself is out of scope unless you add it in.
Do you need our source code?
No. Testing is black-box by default against the running edit and admin UI, the published site, and the Content Delivery API or Content Graph endpoints your front end calls. A grey-box option, reviewing your custom controllers, blocks and access rights configuration alongside testing, is available for faster or deeper coverage.
Does Optimizely have a penetration-testing policy we need to follow?
Yes, for DXP. Optimizely’s current documentation requires customers planning their own test to notify Optimizely at least 10 business days beforehand, by submitting a support ticket with the test type and approach, contact details for emergencies, expected start and end times, and the IP addresses or DNS names the test will originate from. We confirm your instance’s current terms with you during scoping before any testing starts, since a self-hosted deployment does not carry the same process.
Is our Content Delivery API and Content Graph included in testing?
Yes. We test what a single key, Content Graph’s read-only public authentication method, can actually retrieve against your schema, plus what any Bearer, HMAC or Basic-authenticated calls can reach at the access level they run, and the headless Content Delivery API endpoints your front end calls.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Optimizely CMS instance
Optimizely CMS has no hidden admin URL, so group permissions and virtual roles are the entire access control layer. We test whether those permissions hold on the admin UI and the API. CREST-certified testers, fixed price from £3,380 for a 3-day single-instance scope, quoted within 24 hours.
