How to use the Penetration Tester

A step-by-step guide for customers who already have the Penetration Tester in one of their seats.

By Al, BuzFind founderUpdated Portland, Indiana (Reading, PA roots)
Penetration Tester AI agent - Outside-In Security Checks
The Penetration Tester - Outside-In Security Checks

This guide shows you how to run the Penetration Tester, what to type, and how to read what it sends back. To see what it checks and which plans include it, read the Penetration Tester page.

Before you start

  • Your address with https, like https://yourbusiness.com, so the check sees the same version your visitors get.
  • Access to your hosting settings, or the contact for your web person. Security headers are changed in server or hosting settings, not in page text.
  • The Penetration Tester picked in one of your seats under My AI agents, with Save selection clicked. If it is not, its findings show as Locked.

Step by step

  1. Sign in and open My AI agents in the dashboard menu. Click the Penetration Tester to put it in one of your seats, then click Save selection.
  2. Open the Dashboard page. In the chat box, type what you need in plain words and include your website address.
  3. Wait while the check runs. The answer shows in the chat, and the full report is saved under Audit reports & fixes.
  4. Make the changes you agree with, then send the same request again to see what is still open.

What to type in the chat

Copy one of these requests and change the details to match your business.

“Run a security check on yourbusiness.com”
The main request. It starts the Security Audit, which the Penetration Tester runs with the Security Sentinel.

“Check yourbusiness.com for security problems”
Plain wording like this also starts the same Security Audit.

“Check the security of yourbusiness.com/contact/”
Use this for a page with a form, since the check starts from the page you type.

“Run a full site audit on yourbusiness.com”
Use this when you want security looked at along with speed, content and the rest.

How to read the results

  • Items are tagged critical, high, medium or low. Start at the top of the list.
  • Each item names what it saw, like a missing header or a server header that shows your exact software version.
  • Items about old JavaScript libraries or HTTPS come from the one Google PageSpeed test, so they apply to the page you typed.
  • Flagged by: shows whether the Penetration Tester or the Security Sentinel found each item. When both found it, both are listed.

What to do next

  • Send the header items to your host or web person, using Copy fix instructions.
  • Add or change one header at a time and test your site after each one. A strict Content-Security-Policy can block scripts your site needs.
  • Run the Security Audit again after the changes to confirm the items are gone.

Tips

  • Check your own site, or a site you manage with the owner's OK.
  • If a finding looks wrong, look at that exact header in your browser's developer tools before you change anything.
  • Slow pages and SEO problems belong to other agents. The Penetration Tester stays on security.

Questions about using it

How many pages does the security check read?

The Security Audit reads up to 3 pages, starting from the address you type. It also runs one Google PageSpeed test on that address.

Do I need to warn my host before I run it?

No. It sends normal page requests like a browser does, so it looks like a regular visit.

Can I check a site that is still on a test address?

Yes, if the test address is public on the internet. Addresses that only work inside your office network cannot be checked.

Agents work better together. Here are specialists that pair well with the Penetration Tester:

  • Security Sentinel - Checks the security settings anyone can see on your site, like HTTPS and security headers, and returns a report with fixes ranked by severity.
  • QA Automation Engineer - Checks your pages for broken things a visitor would notice: pages that return errors, broken internal links, and pages missing a title or H1.
  • Deployment Lead - Checks your site for problems that often show up around a launch or move: broken pages and links, redirect chains, mixed content, and header settings.

Need a different agent? Browse all 25 agent guides or see the full agent catalog.

Was this article helpful?