Old Website Still Online? The Forgotten Copy Hackers Find First

The email came from a couple planning a summer wedding. They had clicked a marquee hire company's link on an old wedding directory listing, and their phone had landed on a page selling counterfeit handbags, with the company's name still sitting in the browser tab. Was this a scam, they asked. Had the business closed?

It had not. Treat what follows as a composite, assembled from a pattern we meet in migration work rather than from any single customer. A family-run marquee and event hire firm in County Laois had its website rebuilt by a designer two years earlier. The new site was fast, current and on a new host. The old one was never switched off. It sat on the previous hosting account, renewing quietly on a card nobody checked, running a version of WordPress and a set of plugins frozen on the day the business stopped thinking about it.

That frozen copy is the subject of this article. I will use the marquee firm as the thread, because almost every step in its story is one owners take for perfectly sensible reasons.

Why the Copy You Forgot Is the One That Gets Hacked

A website is not a finished object. It is software, and software ages in public.

When the marquee firm moved to its new site, the new one kept receiving updates. The old one received nothing. Every plugin flaw discovered after that date applied to it in full, and nobody was ever going to patch it, because nobody remembered it existed.

The scale of that problem is easier to grasp in numbers. Patchstack's State of WordPress Security in 2026 report counted a little over 11,000 new vulnerabilities across the WordPress ecosystem in 2025, roughly nine in ten of them in plugins rather than in WordPress itself ^[1]. Close to half had no fix from the developer by the time they were disclosed publicly. The report also puts the weighted median time to first exploitation at around five hours, though that measures the flaws attackers actually went after, not every hole on the list.

What two years without updates looks like

So what does that mean for an abandoned install? An old copy is not "a bit out of date". After two years, it carries every publicly documented plugin hole from those two years, on a server that answers anyone who asks. Automated scanners do not care whether an address is your main site. They find what responds, test it against known flaws and move on to the next address.

A maintained site gets patched within days of a fix appearing, which is the baseline set out in our complete guide to WordPress security and backups. The forgotten one never does. That gap compounds every month it stays online.

Where Old Copies Usually Hide

Owners are rarely careless about this. Most simply do not know the copies exist, because somebody else created them. In the migrations we handle, the same five hiding places come up again and again:

1. The previous hosting account. The site moved, but the old account was never cancelled. It renews every year on a card, sometimes a card the bank has since replaced and quietly carried the payment over to.
2. A designer's preview copy. The agency model tends to leave one behind: a version of your site built on the agency's own server, at an address like yourbusiness.theirdomain.com, used for sign-off and then forgotten when the project closed.
3. A staging or "new" address from a rebuild. Addresses such as new.yourbusiness.ie or old.yourbusiness.ie get set up so the rebuild can be viewed before launch, then keep running afterwards.
4. A campaign or second domain. A Christmas promotion site, a separate domain for a product line, the site from before a rename.
5. A test install in a folder. A second WordPress copy in a folder such as /old/ or /wp2/ on the same hosting account as the main site.

The last one deserves extra attention. A vulnerable install sitting in a folder on the same account as your production site is not a separate problem. Depending on how the host isolates accounts, an attacker who gets into the old copy may be able to reach the files of the new one, which is a classic route for the reinfection pattern behind a website getting hacked again after cleaning.

The marquee firm had two of these: the old hosting account, and a "new." address left over from the designer's sign-off stage. Those handbag pages were on the old account. Nobody had touched the second copy. Not yet.

The Damage Does Not Stay on the Old Site

The intuitive response is that the old site does not matter, because no customer goes there. But the couple in the opening proves otherwise. Old links never die cleanly. Directory listings, a newspaper feature from years back, a supplier's "our clients" page, an old social post: all of them keep pointing at addresses that now belong to the abandoned copy.

Search is the bigger exposure. Google's guidance on the cloaked keywords hack describes compromised sites that automatically create many pages of nonsensical text, links and images, pages that can look like normal parts of the site, and states plainly that "the hacked pages show up in Google Search results" ^[3]. The same guidance warns that the owner may see a 404 error at those addresses, because attackers try to convince you the page is gone. Google's spam policies go further: "If a site is hacked, it's not uncommon for the hacker to use cloaking to make the hack harder for the site owner to detect" ^[2].

In plain terms, the spam is built to be seen by Google and by strangers, not by you. When the hacked copy lives on an address carrying your business name, a customer searching for you can find counterfeit goods, pharmacy spam or a fake prize page sitting beside your real listing. That is reputation damage you did not cause and cannot see.

Nobody gets the warning

Search Console has a Security issues report that flags hacked content, but only for properties someone has verified. If the old copy sits on an address nobody verified, nobody is told. The marquee firm had verified its new site and only its new site, so the first alert came from a confused couple rather than from Google.

The Part Nobody Thinks About: The Customer Data Inside

Hacked pages are the visible damage. The quieter risk sits in the database.

Most business sites collect something: a quote request, a booking enquiry, a newsletter sign-up. Many WordPress form plugins store every submission in the database as well as emailing it, and those stored entries stay put long after the site stops being used. In the marquee firm's case, the old site still held several years of quote requests, with names, mobile numbers, event dates and the home addresses where marquees had been delivered and set up.

Two rules that apply to the old database

Two principles from data protection law apply directly. The Data Protection Commission states that personal data must be kept "for no longer than is necessary" for its purpose, and that once the purpose has ended, the data "must be deleted or disposed of in a secure manner" ^[4]. An abandoned site still holding old enquiries is very hard to square with that.

The second is breach notification. Where a personal data breach presents a risk to the people affected, the DPC says organisations must report it "without undue delay and definitely within 72 hours of becoming aware of the breach" ^[5]. Whether a compromised old site counts as notifiable depends on what it held and what the attacker could reach, and that is a judgement to make with a solicitor rather than from a blog post. The uncomfortable point is simpler. You cannot assess a breach on a system you did not know you had, and the clock runs from awareness, not from the moment you have decided what to do.

How to Find Every Copy of Your Website

The National Cyber Security Centre's advice for small businesses puts asset identification first, describing it as "recognising and recording all the valuable assets within your company" ^[6]. A website is one of those assets, and so is every copy of it. For most owners, the inventory below takes about an hour.

1. Search for yourself. Type site: followed by your domain into Google, for example site:yourbusiness.ie. The results show pages indexed under your domain, including subdomains you may have forgotten. Then search your business name and scan the first two pages for anything you do not recognise.
2. Read your bank statements. Look back two years for payments to hosting companies or domain registrars you no longer think of as suppliers. An unexplained renewal is the most reliable sign of an old account.
3. Ask your previous designer, in writing. Ask whether any preview, staging or development copy of your site still exists on their servers, and ask for it to be deleted along with its database. Keep the written reply.
4. Widen your Search Console coverage. Ask whoever manages your domain to verify a domain-level property, which covers every subdomain under it. The Security issues report then watches copies you have not found yet.
5. Write it down. For each address, note where it is hosted, who holds the login, and whether it stores form entries or customer accounts. One page is enough.

Retiring an Old Copy Without Making Things Worse

Finding the copy is half the job. Deleting it carelessly creates new conflicts, so treat it like any other production change: plan it, verify it, then deploy it.

Export before you delete

Take a full backup archive of the old copy and store it offline. Export any form entries you are genuinely required to keep, and let everything else go. Keeping old records "just in case" is exactly what the storage limitation principle discourages.

Redirect the addresses people still use

If old pages still have links pointing at them from directories or press coverage, set up permanent (301) redirects from those addresses to the matching pages on your current site. The couple's wedding directory link should land on the marquee hire page, not on an error. A good host will set this up for you, and it carries across whatever search value those old links hold.

Remove the install, then the account

Delete the WordPress files and the database, then cancel the old hosting account, and ask whoever manages your domain to remove any leftover subdomain that pointed at it. Order matters here. Cancel the account first and you can lose the chance to export or redirect anything.

Verify it is gone

Repeat the site: search, load every old address on your phone over mobile data, and confirm each one either redirects or returns nothing at all.

One limitation is worth knowing before you start. Deleting a hacked copy does not remove it from Google's results straight away. Indexed pages can linger for weeks until Google recrawls them and finds them gone, and the Removals tool in Search Console only hides them temporarily while that happens. If the copy was hacked, request a review from the Security issues report once every affected address is clean, because Google is explicit that fixing only some pages does not earn a partial return to search results.

What a Properly Run Setup Changes

Step back from the clean-up and the real lesson is about how many copies of a website exist in the first place. A sound setup has a handful of clear properties:

• One production environment you control, with the login in your name rather than a supplier's.
• Staging that lives inside the platform: private, created and removed in a click, rather than a stray public copy at a guessable address.
• Backups held by the host and restorable on demand, so nobody keeps old zip files or duplicate installs "for safety".
• Security that runs without anyone remembering: automatic certificate renewal, intrusion prevention, malware scanning.
• A known data location, so you can answer the question of where your customers' details actually live.

Measured against that list, the agency model is where many stray copies come from: a preview build on the designer's server, a "new." address for sign-off, and an old site nobody was asked to retire. Building the site yourself on one platform removes most of those moments.

With Web60, you describe your business and the AI builder produces a full WordPress site in under a minute, on an account you own from day one. Staging is one click and part of the platform. Nightly backups with one-click restore, on-demand backups and automatic pre-update snapshots mean there is no reason to keep a duplicate install as insurance. Server-level hardening, fail2ban and automatic malware scanning all run on Irish sovereign cloud infrastructure where your data stays in Ireland, for €60 a year with nothing added on.

If you are moving from another host, Web60's free migration service brings your existing site across. Retiring the old account afterwards is still your decision, and the inventory above is how to make sure it actually happens.

Where this approach is not enough

There is a scale where this approach stops being enough. A business running a dozen domains across several brands, with its own IT person, is better served by enterprise managed hosts offering organisation-wide dashboards and dedicated monitoring of every internet-facing address it owns. That is a real need. It is not the need of most local firms with one website and perhaps one forgotten copy.

And if your old copy turns out to be a single static page with no WordPress, no forms and no database behind it, the risk is far lower. Retire it tidily, but there is no emergency.

Before the Next Renewal Email

The marquee firm's story ends well enough. Within a week the handbag pages came down, the old enquiries were exported where needed and then deleted, the directory link now lands on the right page, and the designer confirmed in writing that the preview copy was gone. It took an afternoon and a few awkward phone calls.

The useful habit is the inventory, not the panic. Know every address that carries your business name, where each one is hosted and who holds the login, and update that list whenever a site is rebuilt, a supplier changes or a campaign ends. If the list comes back with one entry, you are in good shape. Should it come back with three, you now know exactly which two to retire.

Frequently Asked Questions

Is it dangerous to leave my old website online after building a new one?

If the old copy runs WordPress or any other software, yes. It stops receiving updates the day you stop thinking about it, so every plugin flaw discovered afterwards applies to it in full. Automated scanners find it just as easily as your main site, and if it is hacked the spam pages can appear in Google under your business name. A single static page with no software, forms or database is a much lower risk.

How do I find out if an old copy of my website is still online?

Search Google for site: followed by your domain to see what is indexed under it, including forgotten subdomains. Check two years of bank statements for payments to hosting companies or registrars you no longer use, ask any previous designer in writing whether a preview or staging copy still exists on their servers, and make sure a domain-level property is verified in Google Search Console so the Security issues report covers every subdomain.

Will deleting my old website hurt my Google rankings?

Not if you redirect the old addresses that still have links pointing at them. Set up permanent 301 redirects from those pages to the matching pages on your current site before you delete anything, so visitors and any search value carried by those links arrive in the right place. Pages with no links and no traffic can simply be removed.

My old website was hacked. Do I have to report it to the Data Protection Commission?

It depends on what personal data the old site held and whether the breach presents a risk to the people affected. Where it does, the DPC says it must be reported without undue delay and within 72 hours of becoming aware of it, and where it does not, you should still record the breach and your reasoning internally. Check stored form entries, customer accounts and mailing lists on the old site, and take advice from a solicitor on your specific situation.

Should I keep my old hosting account as a backup?

No. A running website is not a backup, it is a second site that needs maintaining. Take a full backup archive of the old copy, store it offline, export any records you are legally required to keep, then delete the installation and cancel the account. A host that keeps nightly backups of your current site removes the reason to keep a duplicate install running.

Sources