Hosting Accounts With Five Old Sites in Them

What is living in the account

Open the file manager in many small business hosting accounts and the main site is not alone.

There is a folder called old, another called dev or test, a copy of a previous design, a blog someone started and abandoned, and a zip file of a backup.

Each was put there for a reason, usually during a redesign. Nobody took them out afterwards.

Nobody logs in to them, so nobody updates them. The plugins and software inside stay exactly as they were on the day they were copied.

They are still on the internet, reachable by anyone who finds the address, and still running beside the site that matters.

Why an old copy endangers the main site

On most shared hosting, every site in one account runs as the same user, with the same access to every file in the account.

So an attacker who gets in through an outdated plugin in the old folder can read the main site's configuration file, with its database password, and write into its folders.

Clean the main site without removing the old copy and the attacker simply comes back the same way.

And if the host detects malware or spam being sent, it may suspend the whole account, taking the main site and often the email with it.

What usually turns up

• The previous design, copied to a folder during the last rebuild.
• A test or staging site left running after launch.
• An abandoned blog on a subdomain or a second domain.
• Microsites for an event or campaign that ended years ago.
• Backup files in public folders, downloadable by anyone with the name.
• Installer leftovers, such as setup scripts and sample files.

The fifth is the quietest risk. A backup zip or database export left in a public folder can be downloaded whole, customer details and password records included, by anyone who guesses or finds its name.

Finding them

Start in the hosting control panel. The lists of domains, add-on domains and subdomains show every site the account serves, and the list of databases usually shows one per installed site.

Then scan the main web folder for anything the live site does not use: old, new, dev, test, backup, a year, a designer's initials.

A Google search for site: followed by your domain shows what has been indexed, which sometimes includes an old copy nobody knew was public.

If someone else set up the account, ask them what they put there. They usually remember.

Back up, then delete

Before deleting anything, download a copy of each old site and its database to somewhere outside the hosting account. If something turns out to be needed, it can be restored.

Then delete the files, the database and its user, and remove the subdomain or add-on domain if it has one.

Deleting the folder alone leaves the database behind, taking up space and holding old customer data nobody needs.

Redirect what was public

If an old copy was indexed or linked from elsewhere, redirect its addresses to the matching pages on the live site, or to the home page where there is no match.

Search engines then drop the old copy, and people following an old link arrive on a working page instead of an error.

A redirect is a few lines of server configuration, and it does not need the old files to be there.

A worked example

An environmental consultancy doing site assessments and soil testing for builders and landowners had one hosting account holding its main site and five others.

There was a copy of the 2013 site in a folder called old, a test install from the last redesign, and a subdomain for a workshop series that ended in 2015.

A former employee had started a blog on a second domain, and two backup zips sat in the public folder.

In September the host's malware scan flagged a fake document-sharing login page inside the old folder, planted through a slider plugin nobody had updated in four years.

The same intruder had also written a file into the main site's uploads folder.

The cleanup copied everything old offline, then removed the old folder, the test install and both backups.

The workshop subdomain became one page on the main site, and the blog's useful posts moved there too, with redirects from their old addresses.

Every password in the account was changed, and the account now holds one site.

What must stay gets its own account

Some extra sites are genuinely needed: a second business, a booking site, a site for a sister company.

Give each its own hosting account, so each runs as a different user and a problem in one cannot reach the files of another.

Many hosting plans allow several separate accounts, and the cost is small next to cleaning two sites at once.

Staging sites done properly

A staging site, a copy used to test changes before they go live, is good practice. Leaving one open to the world is not.

Put it behind a server password, block search engines from it, and update it whenever the live site is updated.

When the project ends, delete it, or keep it on the same update schedule as the live site rather than frozen on the day it was made.

The counter-case

An account that holds only the live site, set up recently by someone who cleans up after themselves, needs only a look to confirm it.

Some hosting setups already run each site separately, which limits how far a problem spreads, though it does not make an outdated copy any less of a target.

For most accounts that have been through a redesign or two: find the extra sites, back them up offline, delete what is not needed, and isolate the rest.

The order to do it in

1. List every domain and subdomain the account serves.
2. List the folders and databases behind each.
3. Ask whoever set it up what they left.
4. Download offline copies of everything old.
5. Delete files, databases and users no longer needed.
6. Redirect old public addresses to live pages.
7. Move needed extra sites into separate accounts.

Step five is where the risk actually leaves the account. Until the old copies are gone, the main site is only as safe as the most neglected one beside it.

Knowing who owns the account in the first place is covered in hosting paid on the designer's credit card.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.