Tech teamRunning a website or small org
Security misconfiguration
Doors left open: default passwords, exposed panels, missing settings.
Understand it
The second-largest web risk in OWASP 2025. Not a clever intrusion, but things left in their risky default state: admin panels on the open internet, default credentials, revealing error messages, absent security headers.
How to spot it
Default logins still in place, test pages live, detailed errors shown to the public, no security headers set.
Close the gap
- Change every default password and remove sample or test accounts.
- Keep admin interfaces off the open internet, or behind strong sign-in.
- Add security headers and a Content Security Policy - see the Toolkit.
- Review settings after each deploy; harden, do not simply ship.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.