Old scripts on the host: the site was updated, the way in stayed

The site moved to a new CMS, the design was delivered, and the old files stayed on the host. A calendar, a resume upload, a test payment, a panel that was installed "for an hour". They are not in the menu. They open for whoever knows the address, or whoever looks for such addresses in bulk. The new storefront can look tidy, and the owner sincerely believes the site is "fresh".

This is better cleaned from a list than from hope. What else sits next to the current site. Who is allowed to delete it. Whether a live database or a mail form still hangs on the old script. Deleting without a copy can also be a mistake: sometimes the forgotten file is the only place left for a module the live site still calls.

Signs you should look past the homepage

• The host has several folders with different years and different CMSs.
• Search shows an address that is not in the menu.
• Lead mail still arrives from an old form, although "it was removed".
• Contractors changed, and the file access to the host has been shared ever since.

A website security audit approaches from this side: not a design review, but what answers on the network. Lexora does the basic pass for free for new clients. If an old script already looks like someone else's, we bring in incident response and do not start by reinstalling the whole site blindly. We honestly postpone a pentest of the new storefront while an old uploader is still alive on the same host.