All Categories
Security
Security Testing Policy: Requirements for Vulnerability Scanning and Penetration Testing

Security Testing Policy: Requirements for Vulnerability Scanning and Penetration Testing

Guidelines for requesting authorization for security testing and consequences of unauthorized scanning activities.

Security Testing Policy: Requirements for Vulnerability Scanning and Penetration Testing

Overview

This article outlines WPCloud's mandatory requirements for conducting any security testing, vulnerability scanning, or penetration testing against our infrastructure. Understanding and following these guidelines is crucial to prevent service disruptions and maintain compliance with our Terms of Service.

Prerequisites

  • Active WPCloud hosting account
  • Details of planned security testing activities
  • Testing team's IP addresses
  • Written authorization from WPCloud before beginning any testing

Important Notice

⚠️ WARNING: Conducting any security testing, vulnerability scanning, or penetration testing without prior written authorization from WPCloud is strictly prohibited and constitutes a violation of our Terms of Service and Acceptable Use Policy.

Required Authorization Process

  1. Submit Authorization Request
      2. 📌 Important: Authorization requests must come from an authorized WPCloud account contact.

      Email support@wpcloud.ca with the following information:

      • Domain(s) to be tested
      • Testing start date and end date
      • Testing window (time of day)
      • Complete list of source IP addresses
      • Testing tools to be used
      • Company performing the testing
      • Direct contact information for testing team
      • Emergency contact number
  1. Wait for Approval
      • Do not begin testing until you receive written confirmation
      • Approval typically processed within 1-2 business days
      • Keep approval documentation for your records

Automatic Protection Systems

WPCloud employs multiple layers of security protection that will automatically block IPs conducting unauthorized scanning:

  • Imunify360 automated blocking
  • ModSecurity rule triggers
  • DDoS protection systems
  • Brute force protection
📝 Note: These systems cannot be disabled and will block IPs showing scanning behavior, even from authorized users, if proper exemptions are not in place.

IP Blocking and Resolution

If your team's IPs are blocked due to unauthorized testing:

  1. Immediate Actions:
      • Cease all testing activities immediately
      • Provide your blocked IP addresses
  1. Resolution Process:
      • Submit required authorization request
      • Wait for approval and IP whitelisting
      • Resume testing only after confirmation

Terms of Service Violations

Unauthorized security testing is considered a serious violation:

  • First Occurrence: Warning and temporary IP block
  • Repeated Violations: May result in:
    • Immediate service suspension
    • Account termination
    • Potential legal action

Best Practices

  1. Submit authorization requests at least 5 business days before planned testing
  1. Maintain detailed testing logs
  1. Stay within approved testing windows
  1. Use only approved testing IPs
  1. Keep emergency contacts readily available

Common Issues and Solutions

  • Issue: IP blocked during authorized testing
    • Solution: Contact support with your authorization reference number
  • Issue: Emergency testing requirements
    • Solution: Submit urgent ticket through support portal

Support Options

Related Articles

Did this answer your question?
😞
😐
🤩

Last updated on December 10, 2024

Securely Sharing Passwords with Support Setting up SPF Records for MailChannels Email Authentication