{"id":7501,"date":"2024-10-17T09:00:00","date_gmt":"2024-10-17T09:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/04\/02\/post_id-5014\/"},"modified":"2026-07-04T12:24:31","modified_gmt":"2026-07-04T12:24:31","slug":"why-every-relaunch-needs-a-security-audit-lessons-from-50-web-projects","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2024\/10\/17\/why-every-relaunch-needs-a-security-audit-lessons-from-50-web-projects\/","title":{"rendered":"Why Every Relaunch Needs a Security Audit  &#8211;  Lessons from 50 Web Projects"},"content":{"rendered":"<p><strong>Over 50 web projects  &#8211;  each post-launch audit found vulnerabilities. Open admin accesses, forgotten staging servers, standard passwords. A relaunch without a security check is like playing Russian roulette.<\/strong><\/p>\n<h2>TL;DR<\/h2>\n<ul>\n<li>87 percent of relaunches go live without a security review<\/li>\n<li>Top-3: staging accesses, default credentials, missing HTTPS redirects<\/li>\n<li>Pre-launch check: 2-4 hours, a fraction of the time needed for remediation<\/li>\n<li>Scanners find 60 percent  &#8211;  the critical 40 percent require manual inspection<\/li>\n<\/ul>\n<h2>The Relaunch Trap<\/h2>\n<p>Launch day checklist: redirects, DNS, analytics. What\u2019s missing: turn off staging, revoke dev accesses, disable debug, add security headers.<\/p>\n<h2>Most Common Vulnerabilities<\/h2>\n<p><strong>Staging:<\/strong> staging.example.com remains online  &#8211;  weak passwords, no WAF.<\/p>\n<p><strong>Credentials:<\/strong> admin\/admin, API keys in JS, DB passwords in config files.<\/p>\n<p><strong>Mixed Content:<\/strong> HTTP on HTTPS enables MITM attacks.<\/p>\n<h2>Conclusion<\/h2>\n<p>Two hours of checking can save months of cleanup. The checklist is simple  &#8211;  the discipline is hard.<\/p>\n<h2>Key Facts<\/h2>\n<p><strong>Staging Exposure:<\/strong> 18 percent of websites accessible via forgotten subdomains (Detectify).<\/p>\n<p><strong>Time to Exploit:<\/strong> 15 minutes after disclosure, scanners find new vulnerabilities.<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Is a scanner enough?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">For basics. Business logic requires manual inspection.<\/p>\n<\/details>\n<details>\n<summary><strong>Who should perform the check?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Ideally someone outside the project.<\/p>\n<\/details>\n<details>\n<summary><strong>What are the costs?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">2,000-8,000 Euro. Always cheaper than the alternative.<\/p>\n<\/details>\n<h2>Related Articles<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/03\/05\/post_id-3821\/\">secIT by Heise 2026: The security roadshow for admins and IT decision-makers<\/a><\/li>\n<li><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/03\/05\/cybersec-europe-2026-brussels-security-conference-at-the-heart-of-eu-regulation\/\">Cybersec Europe 2026: Brussels&#8217; security conference at the heart of EU regulation<\/a><\/li>\n<li>it-sa Expo &#038; Congress 2026: Europe&#8217;s largest IT security trade fair in Nuremberg<\/li>\n<\/ul>\n<p style=\"font-weight:700;color:#e6e3da;font-size:1.05em;margin:48px 0 16px;\">More from the MBF Media Network<\/p>\n<div style=\"display:flex;flex-direction:column;gap:14px;margin-bottom:40px;\"><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/02\/28\/cloud-trends-2026-was-it-entscheider-jetzt-auf-dem-radar-haben-muessen\/\" class=\"st-net-card\" style=\"display:block;padding:16px 18px;background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 2px 10px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;\"><span style=\"display:block;margin-bottom:6px;font-size:0.72em;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;color:#0bb7fd;\">cloudmagazin<\/span><span style=\"display:block;color:#e6e3da;line-height:1.45;\">Cloud trends on cloudmagazin.com<\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/eu-ai-act-2026-was-unternehmen-jetzt-umsetzen-muessen\/\" class=\"st-net-card\" style=\"display:block;padding:16px 18px;background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 2px 10px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;\"><span style=\"display:block;margin-bottom:6px;font-size:0.72em;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;color:#d65663;\">Digital Chiefs<\/span><span style=\"display:block;color:#e6e3da;line-height:1.45;\">IT strategies on digital-chiefs.de<\/span><\/a><\/div>\n","protected":false},"excerpt":{"rendered":"Over 50 web projects &#8211; each post-launch audit found vulnerabilities. Open admin accesses, forgotten staging servers, standard passwords. A relaunch without a security check is like playing Russian roulette. TL;DR 87 percent of relaunches go live without a security review Top-3: staging accesses, default credentials, missing HTTPS redirects Pre-launch check: 2-4 hours, a fraction of [&hellip;]","protected":false},"author":10,"featured_media":5016,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"security audit","_yoast_wpseo_title":"Why Every Relaunch Needs a Security Audit - Lessons from 50 Web Projects","_yoast_wpseo_metadesc":"Security audit for relaunch: Avoid data breaches and downtime. Learn from 50+ projects\u2014get your free checklist now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5014"],"footnotes":""},"categories":[215,255],"tags":[],"class_list":["post-7501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","category-praxis-umsetzung-en"],"evm_reading_time_minutes":2,"wpml_language":"en","wpml_translation_of":5014,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7501"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7501\/revisions"}],"predecessor-version":[{"id":19801,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7501\/revisions\/19801"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5016"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}