Why leaving an old WordPress installation on your server is a security risk

While developing or redesigning a WordPress site, it is common to create temporary copies or keep old versions of the site in folders such as /old, /backup, /oldsite and so on.
But once the new site goes live, these installations are often forgotten.

Yet an old WordPress installation left on the server can be a real danger. Even if it is no longer linked to the main domain, it remains reachable and vulnerable.

Why it is a real risk

1. WordPress and the plugins are not up to date
   Old installations often contain outdated versions of the core, plugins and themes. These versions may have known, documented security holes that anyone can exploit.
2. They are often not protected by a password or access restrictions
   Because they are no longer “in use”, these areas are not protected by authentication or IP restrictions. Yet they can still be reached by anyone who knows where to look.
3. An attacker can use it as a way into the live site
   Even if users cannot see it, the old installation often shares the same hosting space and therefore the same resources. A single vulnerability is enough to compromise everything.
4. SEO and reputation risks
   If Google indexes the old pages, they can generate errors, duplicate content or worse: be exploited for spam, malware or phishing.

How to check for forgotten WordPress installations

• Connect via FTP or the file manager and look for folders such as /old, /test, /backup, /wp-old
• Look for duplicate wp-config.php files in subfolders
• Use security scanners such as Wordfence to identify multiple installations on the same domain

What to do if you find an old installation

• If you no longer need it: delete it completely from the server
• If you want to keep it: move it to a local machine or a protected environment
• If you have to leave it online for some reason:
  • Protect access with a password (htpasswd or a plugin)
  • Block indexing with robots.txt and a noindex meta tag
  • Update WordPress, plugins and theme to the latest version

An unprotected old installation is like leaving a back door open in your digital office.
Even if nobody uses it any more, it can become the favourite way in for anyone who wants to attack you.

If you have doubts or would like a full review of your hosting space, contact me: I can help you find hidden risks and secure your site.