A test copy of the site on the internet: a forgotten address with live data

Before a release someone makes a copy: test.site.com, dev, staging, or a folder with an old year in the name. It is convenient for showing changes. Then it is forgotten. The copy stays on the internet, with a form, an admin panel and sometimes a database that was refreshed "so it matches production". The password there is simpler, nobody set the headers, and a search engine has already brought a person to it.

Why this copy is riskier than production

• Limits that were turned on for production at the last minute are off here.
• An admin sign-in, or the password from the client handout.
• A database of live leads, because "that makes it easier to test mail".
• The certificate is expired, and staff are used to clicking "open anyway".

The working rule is short. A test address does not face the internet without a password on the whole site. Live data is not copied there. After delivery the address is turned off, or it dies with the task. If a copy is needed for a long time, it has its own secret and it is not in search.

In a Lexora audit these addresses surface immediately: a forgotten subdomain is often more interesting than the homepage. The basic pass is free for new clients. If the copy already held a database, we treat that as an incident and look at what could have been taken, rather than merely "closing the folder". Starting a production pentest from the storefront while a staging site sits open without a password makes little sense.