The New Website Launches Friday: The Security Review That Comes First

The new website launches Friday. The agency did beautiful work, the CEO has seen the homepage, and nobody has asked what the contact form does with submissions, which plugins came with the theme, or whether the old site is really going offline. Security will hear about the launch Monday, from the scanning report.

Marketing sites feel low-stakes because they hold no production systems, but they are the company's public face and its most-scanned asset. A neglected plugin or an exposed admin page on the brochure site is how the company's name ends up in a breach notification that starts 'our website vendor.'

The review that prevents this is one day, run before launch, on a short checklist. It is the cheapest gate in the company.

Key takeaways

• The marketing site is the most-attacked thing you own; treat launch as a security event.

• Review the forms: where submissions go, what they collect, who can see them.

• Inventory the plugins and integrations; every one is a dependency with an update burden.

• Confirm the old site is actually decommissioned, not just unlinked.

• Assign ownership of the site's security after the agency's work ends.

Step 1: Follow every form to its destination

Contact forms, quote requests, newsletter signups: for each one, trace where the submission goes, what it collects, and who can access it. The answer is sometimes a surprise: an inbox nobody monitors, a third-party form tool with its own data retention, a spreadsheet synced to a personal account.

Decide deliberately what each form should collect. Every field is data you now hold, and the discipline of protecting sensitive customer data starts with not collecting what you do not need.

Step 2: Inventory the plugins and the platform

List the platform, the theme, and every plugin with its vendor and update status. Each is a standing dependency: the slider plugin abandoned by its author is next year's exploit.

This fictional example shows the inventory for a typical relaunch. It is an illustration, not a prescription.

Component	Vendor	Updated	Action
CMS core	Platform vendor	Current	Auto-updates on
Theme	Agency custom	At launch	Document ownership
Form plugin	Commercial, supported	Current	Keep, license renewed
Gallery plugin	Free, unmaintained since 2022	Stale	Replace before launch

The rule for launch: every component has a maintainer and an update path, or it does not ship.

Step 3: Check the edges: admin, DNS, and the old site

Three exposures outlive every launch. The admin login: is it restricted, protected with MFA, and not at the default address? The DNS and registrar: who controls the account, with what authentication, because the site is only as safe as that login. And the old site: is it actually gone?

The old site is the classic miss. It stays running on the old host, unpatched, unmonitored, still answering for your domain's history. The decommissioning checklist applies to websites exactly as to any other system.

Step 4: Assign the owner for after the confetti

The agency's job ends at launch; the site's security life begins there. Name the internal owner responsible for updates, for the monthly patch check, and for the question of who calls whom when the site is defaced on a Sunday.

Set the monitoring: uptime, certificate expiry, and a periodic scan. A marketing site that nobody owns decays from an asset into an incident announcement on a schedule measured in months.

The trust implications reach further than the site itself; the discussion of what a trust center does for enterprise sales shows how the public web presence feeds customer confidence.

The related discussion of trust center is worth your time alongside this one. The related discussion of sensitive customer data is worth your time alongside this one.

Frequently asked questions

Our site is just marketing pages. Why the review?

Because it carries your name, your forms, and your customers' trust, and it is the most-scanned asset you have. The effort is one day; the exposure it prevents is a headline.

Should the agency run the review?

The agency should answer it, but an internal or independent pair of eyes should run it. The agency graded its own homework when it chose the plugins.

What about the site we launched last year without this?

Run the same review now, starting with the plugin inventory and the admin login. The checklist works on live sites exactly as on launches.

A Defensible Next Step

If a site, microsite, or landing page launch is on the calendar, put the one-day review in the plan before the date is announced. If one launched recently without it, the review works retroactively. Book a Decision-Clarity Call if you want the checklist applied.