r/Pentesting rules, stats, and what to post

A source-backed Rankhog guide to r/Pentesting: public rules, community context, posting fit, and startup-promotion risk before you publish.

Members: 90,578
Community age: Created Aug 2012, 14 years
To post: No minimum in the rules
To comment: No minimum in the rules
Self-promotion: Not mentioned in the rules
Links: Not mentioned in the rules
Promo risk: MediumFrom the rules, not from removal counts

Checked November 5, 2026 from the community's public Reddit pages:

Best hours to post in r/Pentesting

No pattern yet. r/Pentesting does not have enough top posts from the last 90 days to name its best hours.

Check r/Pentesting with the best time tool

Subreddits like r/Pentesting

Subreddits like r/Pentesting are r/hacking, r/privacy, r/cybersecurity, r/Scams, r/netsec, r/degoogle, r/AskNetsec and r/OSINT.

r/Pentesting alternatives compared: members, karma to post and self-promo rules.
Subreddit	Members	Karma to post	Self-promo
r/hacking	3M	None listed	Limited
r/privacy	1.7M	None listed	Banned
r/cybersecurity	1.5M	None listed	Limited
r/Scams	1.4M	None listed	Banned
r/netsec	575.2K	None listed	Limited
r/degoogle	564.3K	None listed	Limited
r/AskNetsec	267.6K	None listed	Limited
r/OSINT	253.5K	20 post karma	Not listed

Find more rooms with the subreddit finder

Check a post for r/Pentesting

By Anthony Riera, founder and operator of Rankhog.

Subreddit guides combine public Reddit source URLs, captured rules, visible verification dates, and Rankhog's account-safety workflow.

Rule summary

Keep it Legal: All discussions, posts, and comments must strictly adhere to legal boundaries. Do not promote, endorse, or engage in any activities that violate laws or regulations. Discussions on security testing techniques and methodologies are welcome, but ensure they are conducted in an ethical and lawful manner.
Stay On-Topic: Keep discussions focused on topics related to penetration testing, cybersecurity, and related fields. Off-topic discussions may be removed.
Follow Reddit ToS & Reddiquette: Familiarize yourself with Reddit's site-wide rules and guidelines, and abide by them in all interactions within the subreddit.
Avoid Revealing Sensitive Information: Refrain from sharing sensitive or confidential information, including personally identifiable information (PII) or proprietary data.

Works well

A methodology writeup for an authorized test on your own lab or systems, with the setup and lessons learned
A question asking how experienced testers approach a specific assessment phase, like scoping or reporting
A discussion post about a tool or technique for legal security testing, with a real problem it solves
A career or learning post about how to get into ethical penetration testing lawfully
A breakdown of a defensive lesson learned from a simulated attack, with no client data included

Avoid

Posting anything that promotes, endorses, or asks about illegal hacking, since “Keep it Legal” covers every post, comment, and discussion
Dropping a generic tool announcement or promo with no connection to penetration testing, since “Stay On-Topic” lets moderators remove off-topic posts
Sharing screenshots, logs, or reports that contain real client data, credentials, or personal details, because “Avoid Revealing Sensitive Information” bans PII and proprietary data
Arguing with people or attacking other users, which breaks site-wide rules under “Follow Reddit ToS & Reddiquette”
Asking for help testing a system you do not own or have written permission to test, which sits on the wrong side of the legality rule
Posting without checking Reddit's site-wide rules first, since rule three makes following them part of this subreddit's own rules

What r/Pentesting Is For

This community is about penetration testing, which is a security exercise where a cyber security expert tries to find and exploit vulnerabilities in a computer system. The point of the simulated attack is to find weak spots in a system's defenses before real attackers can use them. So the people here are security testers, and people curious about or working in cybersecurity, talking about how these exercises are done. The rules make one thing very clear: everything must stay legal and ethical. You can talk about testing techniques and methods, but the room is built for lawful professional work, not for anything that crosses a legal line.

Rules That Matter Before Posting

The rule that decides most posts here is “Keep it Legal”. It says every discussion, post, and comment must strictly follow legal boundaries, and it bans promoting, endorsing, or engaging in anything that breaks laws or regulations. It does leave the door open for discussions on security testing techniques and methodologies as long as they stay ethical and lawful. Next comes “Stay On-Topic”, which keeps posts focused on penetration testing, cybersecurity, and related fields, and warns that off-topic discussions may be removed. “Follow Reddit ToS & Reddiquette” points to Reddit's site-wide rules, which is the usual catch-all that catches spam and bad behavior. Finally, “Avoid Revealing Sensitive Information” bans sharing personally identifiable information or proprietary data, which matters if you post case studies, screenshots, or reports. The rules say nothing specific about promotion, links, or AI content, so treat those as unknown and lean conservative.

What To Post

A good post here is genuinely about penetration testing and it is clearly lawful and ethical. Write about a methodology, a technique for authorized testing, a lesson from a legal engagement, or a question about how professionals approach a specific kind of assessment. If you are a founder in the security space, the respectful play is to share real substance first, like a writeup of a technique used on a system you own or have permission to test, and let any connection to your work stay in your profile or a follow-up comment. Make sure whatever you share contains no sensitive or confidential information, no PII, and no proprietary data from clients. If your post would help a pentester do their legal job better, it likely belongs here.

What To Avoid

The fastest way to get removed is to break “Keep it Legal”, which means no promoting, endorsing, or engaging in activities that violate laws or regulations. That covers anything from illegal hacking talk to sketchy gray-area requests. “Stay On-Topic” gets posts removed if they drift away from penetration testing and cybersecurity, so a generic SaaS launch post or an unrelated marketing question is at risk. Sharing confidential material, PII, or proprietary data violates “Avoid Revealing Sensitive Information”, so scrub client names, real system details, and personal data out of anything you post. And “Follow Reddit ToS & Reddiquette” means standard Reddit rules apply to how you treat people and how you behave in the thread.

Use Rankhog before posting in r/Pentesting

Want the version that does not run out? Subscribers get unlimited tool runs and more careful checks before posting.

Get my free Reddit SEO audit

Start your 7-day free trial. Card required. $99/month after trial. Next, connect a verified Reddit account; no strategy starts until you explicitly start Rankhog.

Reddit shadowban checker

Check whether a Reddit account is shadowbanned or suspended, or whether one post or comment was removed and by whom.

Reddit warm-up plan calculator

Enter an account's karma and age to get Rankhog's real warm-up plan: how many days, and what to do each day.

Reddit post checker

A free AI moderator simulation that checks your draft against published subreddit rules and six Reddit-native removal risks before you post.

Reddit account analyzer

Look up any Reddit user's post karma, comment karma and account age, and see how many subreddit posting rules the account clears.

Subreddit stats checker

Look up a subreddit's members, weekly visitors, age, growth and the karma and account age it asks of new posters.

Best time to post on Reddit

See when a subreddit's top posts actually went up, hour by hour across the week, with the three best hours on your own clock.

Reddit cake day checker

Find any Reddit account's cake day, its exact age, and when it becomes old enough for the subreddits it wants to post in.

Subreddit finder

Type a subreddit or a topic and I'll show you up to 12 subreddits from our guides. Each row has the member count, the karma and account age to post, and whether self-promo is allowed.

Common questions about r/Pentesting

What subreddits are similar to r/Pentesting?

Subreddits like r/Pentesting are r/hacking, r/privacy, r/cybersecurity, r/Scams, r/netsec, r/degoogle, r/AskNetsec and r/OSINT.

Can I post about my own pentesting tool or product?

The rules do not say. Promotion is not mentioned anywhere in the published rules, so the honest answer is unknown. The safest reading is that anything legal, on-topic, and free of sensitive data follows the letter of the rules, but lead with real substance and not a pitch.

Can I discuss testing techniques and methodologies?

Yes, methodology discussion is explicitly welcomed. “Keep it Legal” says discussions on security testing techniques and methodologies are welcome as long as they stay ethical and lawful.

Can I share a walkthrough of a pentest I ran?

Not by the letter of the rules, but be careful. Make sure the scenario is clearly legal and authorized, and never include real target names, IPs, or client data, because “Avoid Revealing Sensitive Information” applies to case details too.

Can I post screenshots of a tool or report?

The rules ban personally identifiable information and proprietary data, not tool screenshots specifically. Just double check every screenshot for usernames, hostnames, or customer data before posting.

Are links allowed?

They are not mentioned in the published rules at all, so treat that as unknown and assume the usual Reddit expectations apply.