Forgotten subdomains and test stands

A campaign subdomain, an old contractor landing, a stand "to look at the layout" often outlive the project. DNS remembers them. Homepage monitoring does not. The stand meanwhile holds a dump of the live database and a login with no second factor, because "it is not production".

How to assemble the list you do not have

• Export the DNS records instead of recalling domains from memory.
• Look at certificates and hosting panels: names appear there that are not in the marketing sheet.
• For each name decide: live, someone else's, or junk. Take the junk down, including from DNS.
• On the stands that remain, remove live data and close sign-in the same way as on production.

A test stand is useful. A stand nobody remembers, which talks to the same database, is dangerous. If it needs data, that is a de-identified export and a separate password, not a copy of customers "so it looks real".

In a Lexora audit the domain inventory is the first item. Without it, a review of the homepage looks at the most cared-for door.