Is my test or staging site visible to the public?
Worth a look
Often, yes — and usually nobody meant it to be. Test and staging copies of a website get built in a hurry, left on an address like staging.yoursite.co.uk, and quietly forgotten. They're rarely secret: the addresses are published in public certificate records that anyone can search.
How these get found
There's a common assumption that an address nobody has linked to is effectively private. It isn't. Every time a security certificate is issued for a hostname, that hostname is written into a public, permanently searchable log called Certificate Transparency.
This is a good system — it exists so that a certificate wrongly issued for your domain can be spotted. But a side effect is that “staging.yoursite.co.uk” becomes a matter of public record the moment it gets a certificate.
Gus reads those same public logs, along with published DNS records. He doesn't guess addresses, doesn't try passwords and doesn't go looking inside anything — he checks whether the addresses your own records advertise happen to answer.
Why a forgotten staging site is a soft spot
Staging sites are built to be convenient, not defended. Weak or shared passwords, debugging switched on, error messages that reveal file paths, and an old copy of the live database with real customer data in it are all normal on a staging box and all unfortunate in public.
They also tend not to get updated. Your live site gets patched; the staging copy from the last redesign sits on a two-year-old version of everything, on the same server, indefinitely.
And there's a plain commercial version of the problem: a half-finished redesign, old pricing, or a client's name you'd rather not advertise, all publicly readable.
What to do about it
The usual answer isn't to delete anything. It's to put the address behind a password, restrict it to your team's network, or simply switch off the machine if the project ended.
If a staging site does need to stay reachable, make sure it isn't also being indexed by Google — a staging copy competing with your real site in search results is its own problem.
How to check this yourself
- Go to crt.sh and search for %.yourbusiness.co.uk — the % is a wildcard. This lists every hostname anyone has ever issued a certificate for on your domain.
- Read down the list for anything that looks internal: staging, dev, test, uat, admin, old, backup, cpanel, vpn.
- Try opening one or two of them in a browser. If a page loads without asking for a password, it's reachable by anyone.
- Don't try to log in to anything, and don't go poking at other people's domains this way — checking your own is fine, and that's all Gus does.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
A search of public certificate records shows these hostnames on our domain: [list]. Could you tell me which are still needed, and put anything that isn't public-facing behind a password or an IP restriction? If any are retired projects, could they be shut down properly rather than left running?
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.