Security and maintenance for your Shopware store The Doppel­gänger.

A digital twin that keeps your Shopware store up to date and ready to sell, and protects your customers’ data.

With it, updates for Shopware and extensions are tested all the way to checkout and go live without interruption. At night the store is checked for unexpected files, and every morning a test order runs through the entire purchase process.

Request a quote Learn more
Built around SMEs

Maintenance and a safety net for your store.

In most stores everything happens while sales are running: an update, a new payment method, a changed shipping rule. Updates are tedious, risky and tend to get pushed back. Known security holes stay open for weeks. And if something does go wrong, your customer notices at the checkout before you do. Every hour the checkout is stuck costs revenue.

No test systemHoles stay openNo dossier

The Doppelgänger changes that: a test environment that always mirrors your live store. With it, I keep your store up to date, monitor its condition and prevent outages. You don’t have to take care of anything. What used to be reserved for corporations with their own IT, I now make possible for small and mid-sized businesses too.

01 Test store A complete store on a separate server, with anonymized customer data. Updates, payment methods and theme changes are tested there through to checkout, and only then does the live store take over. Learn more
02 Security & updates Regular updates for Shopware, extensions and theme, tested through to checkout first. On top of that, eight automatic checks examine your live store every night. Learn more
03 Dossier Every change is recorded. If an update causes problems, the previous version is back with one click, without downtime or frantic troubleshooting. Learn more
Doppelgänger for Shopware
Since our store got its Doppelgänger, where Julian checks every update and every change first, the store has been running absolutely smoothly. Updates are no longer a big project we keep putting off. We see and test new features there before they go live, and only approve them once everything is right. It has made our work noticeably more productive.
Bettina SanioHead of Marketing & Communications, JuCad®
Since 2020in my careShopware 6with the Doppelgänger
01 · Test store

Tested first, then published.

The Doppelgänger is an exact copy of your store: the same Shopware version, the same extensions, products, prices and order structures. Only the customer data is anonymized on every copy. Meanwhile your live store keeps selling. A regular sync keeps it up to date.

What stays as it is: your hosting, your domain, your payment contracts and your inventory system.

Doppelgänger · checked
Live store

From the request to going live, without risk.

A Shopware update, a new extension, a change to the theme: everything happens on the Doppelgänger first, while your live store keeps selling.

Your live store keeps selling throughout.
From the Doppelgänger menu
Doppelgänger Applied today
Shopware 6.6.9 → 6.6.10Update
Shipping rule “Express”changed
Payment method PayPal Checkoutchanged
Live store keeps selling
Doppelgänger
Live store
4 changes marked Approve
Publishingapprox. 2 min
Backup created14:02
New version built14:03
Switching overrunning
Checking live store
Doppelgänger
As of 14:03
Live store
As of 14:03
Identical last synced today, 14:05 Sync
Versions4 of 128
v128
Shopware update, new shipping ruleToday, 14:03
Live
v127
Payment method PayPal Checkout addedYesterday, 09:41
Restore
v126
Security update Shopware 6.6.9Sep 28, 16:20
Restore
v125
Autumn campaign launchedSep 24, 11:05
Restore

What the Doppelgänger does day to day.

Core feature

Test through to checkout

A new payment method, a changed shipping rule, a Shopware update: you click through the complete order process on the Doppelgänger, show it around and sign off before a real customer sees it.

Flawless publishing

No manual uploads, no forgotten files. The new version is prepared in full and switched over in an instant.

Real orders, no real customers

Names, addresses and payment details are replaced on every copy. So you test with realistic data volumes, without a second database full of personal data.

Worry-free updates

Even a major Shopware update is run through in full with all extensions, through to checkout, before your customers see it.

Prepared for emergencies

An attack is spotted quickly, every change is visible and can be undone. That keeps the damage small.

02 · Why more protection is needed now

Security in the age of AI

AI-assisted programs scan the entire internet around the clock for vulnerable websites. They don’t ask how big your company is, only which version you run. If you update promptly, you close the gap before it is found.

Hours, not weeks

A known vulnerability is often exploited automatically within a few hours, long before “we’ll update when we get around to it”.

Nobody is “too small”

Automated attacks don’t pick a target. They hit every store with a known vulnerability.

The damage is real

Stolen payment data, manipulated prices, a store that sells nothing for days. Cleaning up costs many times more than prevention.

Nightly security checks

While you sleep, your live store is checked, and every morning a test order runs all the way through to payment.

Uptime monitoringMonitored around the clock. Outages are noticed immediately.
Background servicesQueue, scheduled tasks and search index running cleanly.
Security checkCompared against known vulnerabilities in the system and plugins.
Server checkSSL certificates, disk space and services in the green.
System backupBacked up in full every night, independent and encrypted, on servers in Germany.
File comparisonEvery file checked against version control. Anything unexpected stands out.
Plugin inventoryAll Shopware extensions recorded, outdated versions are detected.
Test orderThe complete order process through to payment, checked every morning.
Uptime monitoringMonitored around the clock. Outages are noticed immediately.
Background servicesQueue, scheduled tasks and search index running cleanly.
Security checkCompared against known vulnerabilities in the system and plugins.
Server checkSSL certificates, disk space and services in the green.
System backupBacked up in full every night, independent and encrypted, on servers in Germany.
File comparisonEvery file checked against version control. Anything unexpected stands out.
Plugin inventoryAll Shopware extensions recorded, outdated versions are detected.
Test orderThe complete order process through to payment, checked every morning.
Uptime monitoringMonitored around the clock. Outages are noticed immediately.
Background servicesQueue, scheduled tasks and search index running cleanly.
Security checkCompared against known vulnerabilities in the system and plugins.
Server checkSSL certificates, disk space and services in the green.
System backupBacked up in full every night, independent and encrypted, on servers in Germany.
File comparisonEvery file checked against version control. Anything unexpected stands out.
Plugin inventoryAll Shopware extensions recorded, outdated versions are detected.
Test orderThe complete order process through to payment, checked every morning.
Expert view
Under the GDPR, a neglected website is not a cosmetic flaw. It requires security in line with the state of the art, from small businesses too.
Julian Bräucker
Julian BräuckerDeveloper and operator of the Doppelgänger, Düsseldorf
€65,500
fine for outdated store software alone
03 · Dossier

The dossier.

Every change to your store goes into the dossier: when, what, by whom. Even a year later you can trace when a tax rule or a price was last touched.

Who, what, when

Every change with date, description and author, whether from you, your team, an agency or a freelancer. So you keep track even with many people involved.

Back in seconds.

If something goes wrong, the store is switched back to the last clean version. Individual changes can be undone selectively, without losing anyone else’s work.

A clean handover

New staff or a new agency start with a documented store and a complete dossier. No knowledge locked in one person’s head, no dependence on individuals.

At a glance

Before. After.

Until now
With the Doppelgänger
Testing changes
Directly in the live store, in the middle of trading
On the exact copy, through to checkout
When something goes wrong
Searching, repairing, hoping, under time pressure
Switching back in seconds
Updates
Rare, because risky
Regular, because tested first
Monitoring
You notice when orders stop coming in
Nightly security checks and a daily test order
Backups
Only your hosting’s
Hosting backup plus an independent, encrypted second backup
Costs compared

Updating by hand isn’t cheaper. It just happens less often.

An example calculation: four update rounds a year by hand, the Doppelgänger and a single incident compared.

Updates by hand4 × a year
€900€1,600€3,640
a year, about €75 per montha year, about €133 per montha year, about €303 per month
4 rounds 2.5 h4 h7 h €90/h€100/h€130/h
  • Tested directly on the live website
  • No way back in seconds when something breaks
  • Nobody checks between rounds
The Doppelgänger12 to 24 × a year
Monthly flat fee
tailored to the scope, plus a one-time setup

Per update round less than two hours of a developer’s time, and every round is tested first.Usually costs about as much as four rounds by hand, but updates three times as often and checks every update on the copy first.Less than four update rounds a year at an agency, and monthly instead of quarterly.

  • Every update checked on an exact copy first
  • Version control and rollback in seconds
  • Nightly security checks and an encrypted second backup
When it goes wrong1 incident
€7,690 to €21,350€7,690 to €21,350€11,450 to €34,200
cleanup, forensics, rebuildcleanup, forensics, rebuildnot counting fines and lost sales

For a week the website redirected visitors to casino sites. Five websites on the same server were infected, and so were the host’s backups.For a week the website redirected visitors to casino sites. Five websites on the same server were infected, and so were the host’s backups.For weeks, card details were skimmed at checkout through an outdated extension. It was the bank that reported it.

See the case See the case See the case

Example: 2 to 3 hours per round including backup, updates, clicking through and small fixes, at a median freelance developer rate of €90. Example: 3 to 5 hours per round for WordPress with WooCommerce or a page builder, at €100 an hour. Example: 6 to 8 hours per round for minor updates (an agency’s estimate), at an agency rate of €130. Incident costs: the example calculation from the case, without lost sales. Sources: freelancermap 2025, Patchstack 2026.

Case studies Twelve typical incidents with a cost calculation, and what the Doppelgänger catches. up to €34,200 per incident View
In detail · Shopware

What Shopware involves.

A Shopware store depends on payment providers, shipping services, inventory management and a number of extensions. An update that looks harmless in the admin can block the checkout at any of these points. That is why the Doppelgänger tests all the way to payment.

Shopware updates through to checkout

Patch, minor and major updates of Shopware 6 are applied on the Doppelgänger and tested with a complete order. Only once the test order goes through does the update go live.

Extensions and your own theme

Before every update I check that your extensions from the Shopware Store, custom plugins and theme changes work with the new version. Anything incompatible shows up on the Doppelgänger, not while you are selling.

Payment and shipping in test mode

Payment providers such as PayPal, Mollie or Stripe run in their test modes on the Doppelgänger. You order all the way to payment without any money changing hands or a package being sent.

Customer data stays anonymous

Names, addresses and email addresses are replaced on every copy. You test with real products, prices and order structures, without a second database full of personal data.

Inventory systems and marketplaces

Connections to inventory management, ERP or marketplaces are disconnected on the Doppelgänger or point to test systems. Tests do not create duplicate orders or wrong stock levels.

Moving from Shopware 5

If your store still runs on Shopware 5, the migration to Shopware 6 is rehearsed on the Doppelgänger: several times, with real data and without any risk to the running store.

Related guides

Running Shopware safely

Shopware
From Shopware 5 to Shopware 6: how to get the migration right
What moves over, what has to be rebuilt and how to keep your search rankings.
Learn more
Costs
Shopware Community Edition over €1 million in sales: what now?
What you lose above €1 million GMV, what Rise costs and why switching systems is rarely cheaper.
Learn more
Security
Cyber Resilience Act: what it means for your website or online store (and what it does not)
Who the CRA obliges, who it does not, and what changes indirectly for website and store owners.
Learn more
Staging
Staging environments: host staging, plugin or your own server?
Four approaches compared: isolation, data protection, rollback and suitability for stores.
Learn more
Shopware
From Shopware 5 to WooCommerce: how to get the move right
When WooCommerce fits, what moves over and how to protect your rankings and customer accounts.
Learn more
Costs
Website maintenance: What does it really cost?
Maintenance contracts compared, hours per update round, and what a single incident can cost.
Learn more
Security
NIS2 for small businesses: covered or not, and what your customers are asking now
Who NIS2 covers directly, what customers ask suppliers, and how to answer website questions with evidence.
Learn more
Shopware
How to update Shopware 6 without putting your store at risk
Patch, minor or major: a checklist for backups, staging, extensions and rollback.
Learn more
Security
Online store hacked: what to do now
First steps for Shopware and WooCommerce: skimmers, payment providers, customer data, reporting.
Learn more
Shopware
Replacing Shopware 5: which alternative fits your store?
Shopware 6, WooCommerce, Shopify, JTL-Shop and Magento: costs, effort and which one fits whom.
Learn more
Security
PHP2Shell: what the critical PHP flaw means for your website
What the PHP flaw allows, who is affected and why this time your host has to act.
Learn more
Shopware
Shopware 6 update failed? Causes, the way back, security updates
Narrow down the cause, restore safely, and why security updates cannot wait.
Learn more
Security
PHP2Shell: what to do now
Check the PHP version, ask your host, protect the site meanwhile, look for signs of a break-in.
Learn more
Security
Security in the age of AI: what changes for your website
What AI changes about attacks on websites, what is proven, and which defenses really help.
Learn more
Security
Updates are mandatory: what the GDPR requires of website and store owners
What Art. 32 GDPR requires for updates, backups and access, and what supervisory authorities say about it.
Learn more
WordPress
Critical error after a WordPress update: how to get your website back
Recovery mode, switching a plugin off via FTP, rolling back a version and preventing it in the future.
Learn more
Security
WordPress hacked: what to do now
First steps, signs, backup or cleanup, the Google warning and the reporting duty.
Learn more
WordPress
How to update WordPress safely without putting your website at risk
Why postponing is risky and which routine keeps core, plugins and WooCommerce safe.
Learn more
Getting started

What it takes to get started.

You give me one login, and I set up everything else.

One login

SSH access or a login to your hosting control panel is enough. That is all I need from you.

Two to three days

I copy your store to the Doppelgänger, install the plugin and set up the nightly checks. After two to three days, everything is ready.

A quote for your store

Costs depend on your project. After a first review of your system, you get a quote.

Frequently asked questions

What you might still want to know.

Also worth a look:
Which Shopware versions does the Doppelgänger support?

Shopware 6. If your store still runs on Shopware 5, I oversee the move to Shopware 6. The migration is rehearsed on the Doppelgänger before the live store moves. How that works is described in the guide migrating from Shopware 5 to 6.

Are real payments triggered when I order in the test store?

No. The payment providers run in their test modes on the Doppelgänger. You can order all the way to payment without any money changing hands.

What happens to inventory systems and marketplaces?

On the Doppelgänger these connections are disconnected or point to test systems. That way there are no duplicate orders and no wrong stock levels.

Do I need a maintenance window for updates?

No. The update is prepared and checked on the Doppelgänger, and publishing takes a few minutes without a maintenance page. Orders in progress are not interrupted. More in the guide Shopware 6 updates without downtime.

What happens to orders and customer data in the store?

They stay on the live website, nothing is lost: when publishing, only the checked changes are transferred. For realistic tests, current data can be brought onto the Doppelgänger, with personal data anonymized.

What do you need from my hosting provider?

SSH access to the server your store runs on, and access to the database. Publishing, the copy for the Doppelgänger and the nightly file comparison run through it. Shopware itself needs the command line for updates, so hosting plans for stores almost always include SSH. If you give me access to your hosting control panel, I will set up the access myself.

Where is the data stored? What about data protection?

Everything in Germany: the Doppelgänger runs password-protected in the Falkenstein data center (Saxony), and the encrypted nightly backups are stored there too. Names, addresses and payment data are replaced with every copy, in line with the GDPR.

What does the Doppelgänger cost?

A monthly flat fee based on the size, extensions and interfaces of your store, plus a one-time amount for the setup, both set in the service agreement. For comparison: a hacked store, or a checkout that is blocked for days, usually costs considerably more than a year of Doppelgänger.

Next step

Let’s talk about your store.

In a short conversation I find out what your store needs, how the switch works and what it costs. No obligation, no rush.

The Doppelgängerby jbraucker

Developed by Julian Bräucker, Düsseldorf. Servers in Germany.

Cover for your website. © 2026 Julian Bräucker · jbraucker.com Data center in Falkenstein, Germany