A03 · OWASP Top 10 · 3 min

Software supply chain failures. Your website is built from other people's parts.

Plugins, code libraries, outside scripts, update tools. Each one is a supplier. When a supplier slips, the problem arrives inside your website.

I run a

In 10 seconds

Most of your website is built from other people's parts.

What it is

Most of a modern website is made of parts other people wrote. A supply chain failure is when one of those parts is out of date, tampered with, or fake, and it gets installed anyway.

Why you care

The attacker never touches your site directly. They come in through something you trusted, and can reach your names, addresses, phone numbers and purchase history. OWASP, the industry's list of web risks, now gives this its own place in the Top 10.

What to do

Know what your site is built from, keep it updated, and ask who checks a new part before it goes in.

For your business

What's at stake for you.

I run a

Who is affected

Your customers, and anyone who trusts you with their details.

What could leak

Names, addresses, phone numbers and purchase history.

Ask this first

“Which plugins and themes do we use, who updates them, and have we removed the ones we don't need?”

Where it hides

Pick a supplier your website depends on.

Every one of these is a door that someone else built.

admin > plugins and themes

What's here: Add-ons that give your site extra features: booking, chat, payments, analytics.
What goes wrong: Abandoned, out of date, or sold to a new owner who slips in something harmful. One weak plugin can open the whole site.
Ask your team: Which plugins and themes do we use, who updates them, and have we removed the ones we don't need?
Developers call it: Vulnerable and outdated components, malicious plugin updates

What it costs

You inherit your suppliers' problems.

Out of sight

You can be careful with everything you built and still be hit through something you didn't.

Everywhere at once

One flawed part can sit in thousands of sites, so attackers hunt for it everywhere.

Slow to find

Many businesses can't list their parts, so it takes weeks just to learn if they're affected.

Your name, your fine

Customers and regulators usually hold you responsible, even when a supplier was at fault. Duties vary by country and sector.

For an online shop: a flawed booking and checkout plugin or chat widget could expose names, addresses, phone numbers and purchase history.

Does this apply to you?

Tick what's true. Get your questions.

Firstfor online shop

So the questions fit you

What kind of business do you run?

A real case

The weak link was a chatbot.

Ticketmaster UK, 2018

A supplier's script, running on the payment page.

What it cost: In 2020 the UK Information Commissioner's Office fined Ticketmaster UK £1.25 million.
The lesson: Ticketmaster's own code wasn't changed. A part from a supplier sat in the most sensitive spot on the site, and nobody had asked whether it should be there.

Read the full story and sources

Ticketmaster UK loaded a customer-support chatbot built by an outside supplier, Inbenta Technologies, on its payment page. Attackers altered the supplier's script, and it captured card details that customers typed in. Up to about 9.4 million customers were reported as potentially affected.

In 2020 the UK Information Commissioner's Office fined Ticketmaster UK £1.25 million. It said the company hadn't properly assessed the risk of using the chatbot on its payment page.

Also: in 2021, a flaw in Log4j, a logging library inside countless products, left many organisations spending weeks just finding where they used it. In 2024, researchers at Sansec reported that a widely used script service changed hands and began serving harmful code to more than 100,000 websites. Sources: UK ICO, Apache Software Foundation, Sansec.

Your part

Three decisions that are yours.

01Know what you're built fromAsk for a written, current list of every plugin, library and outside service your site depends on.
02Set an update ruleDecide how fast serious security updates must go in, for example within days, and who is accountable.
03Vet new partsBefore anything new is added, ask who built it, who maintains it, and what it can access.

For your developer: the technical layer

Keep a software bill of materials (SBOM) and scan dependencies automatically in CI, with alerts on new advisories.
Pin versions with lockfiles and verify hashes. Pull only from approved registries, and watch for look-alike package names.
Remove unused plugins and libraries. Fewer parts means fewer doors.
Harden the build pipeline: least-privilege access, a second step on logins, and signed, traceable builds.
Load third-party scripts with Subresource Integrity and a Content Security Policy, and keep them off payment and login pages where possible.
Assess vendors before integrating them, and review what they can reach on a schedule.

Remember

Three things to keep.

Your website is mostly other people's parts. Their problems become yours.
Keep a list, keep it updated, and remove what you don't use.
Ask who checks a new part before it goes in, especially near payments and logins.

What OWASP says

The essentials, slide by slide.

A03 · owasp top 10 · 01/04

OWASP Top 10 · A03

software supply chain failures

Source: OWASP Top 10:2025 (CC BY 3.0) ↗

OWASP is a non-profit that publishes the industry's standard list of web risks. Safety measures adapted from the OWASP Top 10:2025 (CC BY 3.0). The people and businesses in the examples are made up.