Squarespace Security Review
A Squarespace API key or OAuth token is scoped to one site, but still returns public site data regardless of scope. We test what each credential and injection point can reach. CREST-certified testers, fixed price from £2,080 for a 1-day single-site scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Squarespace’s Commerce APIs split into nine separate permission scopes, from Forms to Transactions, but every authenticated key or token still returns basic public site data no matter how narrow its scope is.
Nine API scopes, one shared sliver of public data
Squarespace’s own documentation confirms that an authenticated request automatically gets access to public site data, such as site name, language, currency and location, on top of whatever Read Only or Read and Write scope was granted. We test what a narrowly scoped API key can still see beyond the API it was issued for.
API keys and OAuth access tokens are both scoped to the single site that owns them, but the Webhook Subscriptions API only accepts OAuth, so a custom application built around a simple API key cannot manage its own webhook subscriptions the way a registered Squarespace Extension can. We test which authentication method your integration actually uses and what that choice changes about its reach.
Custom code injected into a Squarespace site through the Custom Code Specification, header and footer scripts, code blocks, runs on every page that loads it, so a single injected script has the same reach as code the site owner wrote themselves. We test what injected code can read, submit or call, and whether it is scoped any tighter than that.
SCOPE
What we pen test on a Squarespace site
API scope boundaries
We test whether a key or token scoped to one Commerce API, such as Inventory, can be used to reach another, such as Orders or Contacts, the same boundary check we run for other website builder integrations.
Public data on scoped credentials
We test what public site data a narrowly scoped API key returns beyond the specific API it was issued for.
OAuth vs API key reach
We test the difference in what an OAuth-authenticated Extension can do compared with a site-generated API key, particularly around webhook subscriptions.
Webhook payload handling
We test whether the endpoint receiving order, inventory or customer webhooks verifies the payload came from Squarespace before acting on it.
Custom code injection points
We test what a script injected through the Custom Code Specification can read, submit or call elsewhere on the site.
Contact and order data exposure
We test who can view customer name, email, address and order data through the Contacts and Orders APIs.
Form submission handling
The Forms API is read-only and built for Zapier integration, so we test how form submissions flow to that integration and what happens to the data along the way.
Discount and pricing manipulation
We test whether the Discounts API or a client-side price value can be manipulated to apply a discount the site did not intend to offer.
Legacy Profiles API exposure
The Profiles API is in maintenance mode, so we test whether it is still active on the site and still returning customer data that new integrations should reach through the Contacts API instead.
Reseller and multi-site access
For reseller or agency accounts managing multiple Squarespace sites, we test whether access to one client site can be used to reach another.
OUR PROCESS
Squarespace Site and Integration Security Review: From Scope to Attestation
Site and integration intake
You give us a test API key or OAuth client scoped to the site under test, plus a list of webhooks and custom code in use.
Scope and injection mapping
We map what each API scope, credential and injected script is meant to reach before active testing begins.
Active testing
We attempt to reach data, APIs and other sites outside each credential’s and script’s intended boundary.
Report and free retest
You get findings mapped to the specific API, credential or script involved, then a free retest once fixes are in.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Squarespace pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Squarespace Site and Integration Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
1 to 2 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote2 to 3 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Squarespace For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Squarespace Site and Integration Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Squarespace site?
A test API key or OAuth client scoped to the site under test, plus details of any webhooks or custom code injected into the site. We do not need your Squarespace account login.
Will testing touch live customer or order data?
We use test orders and contacts wherever the site supports them, and confirm with you before any check that could touch live customer, order or payment data.
How long does a Squarespace review take?
The 1-day single-site scope above covers one Squarespace site, its API use and its custom code. Multiple integrations or a reseller setup managing several sites can need more time, confirmed during scoping.
Do you test Squarespace’s own platform?
No, Squarespace’s hosting and core platform are out of scope. We test your site’s configuration, API credentials, webhooks and injected code.
What is out of scope?
Squarespace’s shared hosting infrastructure is out of scope. We focus on your API scopes, OAuth setup, webhooks, custom code and the data they touch.
Does Squarespace have a customer penetration testing policy?
Vendor terms for testing a shared SaaS platform vary, so we confirm Squarespace’s current policy for your site during scoping and work within it.
Do you need our custom code or integration source?
It is not essential, but sharing injected header, footer or code block content speeds up the review of what that code can reach.
Are your testers CREST certified?
Yes. Every Squarespace review is carried out by CREST-certified, UK-based testers.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Squarespace site
A Squarespace API key or OAuth token is scoped to one site, but still returns public site data regardless of scope. We test what each credential and injection point can reach. CREST-certified testers, fixed price from £2,080 for a 1-day single-site scope, quoted within 24 hours.
