Hostinger bug bounty programs
hostinger.com Updated
Hostinger runs two public programs: a self-hosted bug bounty paying up to $25,000 and a HackerOne bug bounty paying up to $25,000.
- Top reward
- $25,000
- Self-hosted
- Programs
- 2
- 2 pay cash
- Targets in scope
- 14
- 3 types, deduplicated
- Last change
- 5 Nov 2026
- 1 week ago
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Hostinger
Self-hosted · Pays the most of the 2 programs: up to $25,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Hostinger
Self-hosted · Bug bounty |
– | – | – | – | $25,000 | Partial | – | 2 days promised | Open |
|
hostinger
HackerOne · Bug bounty |
$25k (highest) | $5,000 (highest) | $1,000 (highest) | $200 (highest) | $25,000 | Full | – | 5 hours average | Open |
-
- Safe harbor
- Partial
- First response
- 2 days promised
-
- Critical
- $25k (highest)
- High
- $5,000 (highest)
- Medium
- $1,000 (highest)
- Low
- $200 (highest)
- Safe harbor
- Full
- First response
- 5 hours average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
14 targets across all 2 programs, each listed once with the programs that cover it. 2 excluded.
No target matches. Try part of a host name, such as the company name.
Out of scope 2
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Any Site, Service, domain, asset, customer hosted content, or third-party software that is not included within the Bug Bounty Program scope
Self-hosted
-
Issues related to the cPanel platform itself
Self-hosted
Recent changes
Reward and scope changes across every Hostinger program, newest first.
-
Scope + HackerOne
Added to scope: ai-builder.hostinger.com
Recent CVEs
Published vulnerabilities in Hostinger products, from the NVD.
-
CVE-2023-6751 High
The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
-
CVE-2023-6751 High
The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
About this page
This page gathers every public program listed under hostinger.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.