I design a module with onboard test-pads. I put ESD protections to all out-world connections like sockets etc.
But I want to ask that; should I put ESD protections to test-pads and ISP socket inputs?
That depends on the purpose.
If your module is a kind of sample / prototyping platform and you will access the test points often, consider adding ESD protection.
If this is a final product and the pads will be used once in a lifetime during the production test (supposedly in a controlled ESD-free environment), ESD protection will just increase the cost for nothing.
Where I work we often put lots of ESD diodes and current-limiting resistors on the first PCB samples, which are removed in the PCB release which goes in production. Makes sense when the early samples cost $500 a piece and a final product more like $5 a piece.
In theory, you shouldn't need it on a test pad.
In practice, you may need it on a test pad.
In reality, I've never fitted it to a test pad.
ESD protection should be applied to everything which would be exposed to a non-ESD protected environment. This means that every single bit of exposed metal that is touchable by anything outside of an ESD controlled environment needs some kind of protection.
As a general rule, a test pad is only accessible during production and testing. After which, it is in some kind of enclosure, and so that pad is no longer going to be exposed. Again, as a general rule, people will claim that the manufacture and test environments are ESD safe (that is up to debate, as most company's ESD procedure leave a lot to be desired). Once assembled, the test pad is no longer accessible, and so does not need protection.
If you are planning on keeping the PCB as a naked board on your work bench for you to play with, it will be more exposed to ESD, but you can dissipate your own ESD with a wrist strap or similar.
Another thing to take into account is CE marking or similar certification. CE marking requires the product go through ESD testing, to prove that once assembled the product is not susceptible to ESD problems. With good case design, this should mean only the exposed connectors receive a discharge, and so only they need protection. But people often forget about the mounting screws and other areas that a discharge could take place on. With a good case design, your test pad should be clear of any ESD, with a bad case design, a screw or clip or spring could easily bring the discharge onto the PCB.
Final point, very few things fail due to ESD straight away. It usually takes multiple discharges and a bit of time for anything to completely give up the ghost. But everything (even protected things) will be damaged from every discharge. So any protection you add doesn't stop the device failing due to ESD, merely hardens it against ESD, so that the product lasts a bit longer.