Every organization has websites it forgot it owns

Most organizations can name their website. Very few can name all of them. The microsite from a product launch six years ago, the staging server a contractor left running, the subdomain that still points at a cloud bucket someone deleted, the folder of PDFs nobody has opened since the last redesign: they all still carry your name, and in most cases your obligations.

Nobody decides to build a forgotten estate. It accumulates one campaign, one vendor, and one migration at a time, and the people who launched each piece move on. Finding it again is unglamorous work. The payoff is that you stop being surprised, whether by a demand letter about a site you forgot, a phishing page on your own subdomain, or a certificate warning on a page your board still links to.

Where forgotten properties hide

Before you search, know what you're looking for:

• Campaign microsites and event sites on their own domains or subdomains, built by an agency and never handed back
• Staging, development, and preview environments like staging., dev., or old., sometimes indexed by search engines
• The previous platform after a migration: the old CMS or legacy store still running "just in case"
• Vendor-hosted pages with your branding: forms, payment portals, landing pages, surveys, and job boards
• Document archives: PDFs, Word files, and slide decks in upload folders, often linked from nowhere
• Defensive and typo domains registered to protect the brand and never pointed anywhere sensible
• DNS records that point at cloud resources that no longer exist

How to find them

No single source is complete. Use several and merge the results into one list.

Certificate transparency logs

Publicly trusted TLS certificates are recorded in public certificate transparency logs, and crt.sh lets you search them by domain. Every hostname that has ever had a certificate shows up, including ones nobody remembers requesting:

# Every hostname that has appeared on a certificate for your domain
curl -s "https://crt.sh/?q=%25.your-org.com&output=json" \
  | jq -r '.[].name_value' | tr 'A-Z' 'a-z' \
  | sed 's/^\*\.//' | sort -u > hosts.txt

Wildcard certificates hide individual hostnames, so treat this as a starting point, not a census.

Your DNS zone

Export the full zone from your DNS provider and read every record. Pay special attention to CNAME records that point at third-party services: cloud storage, app hosting, static site hosts, CDNs, and SaaS tools. Each one is a dependency on an account someone at your organization has to control. Then check what each hostname actually returns:

while read -r host; do
  cname=$(dig +short CNAME "$host" | head -n1)
  code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 8 "https://$host")
  expiry=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  printf '%s\t%s\t%s\t%s\n' "$host" "${cname:--}" "$code" "${expiry:-no certificate}"
done < hosts.txt

Look for three things in the output: CNAMEs pointing at services that return "not found" errors, certificates that have expired or will soon, and hosts that answer at all when you expected them to be gone.

Sitemaps, search engines, and analytics

• Old sitemap.xml files list URLs the current navigation forgot.
• Search operators show what's indexed: site:your-org.com -site:www.your-org.com surfaces subdomains, and site:your-org.com filetype:pdf surfaces documents.
• Your analytics hostname report shows every host sending data under your account, and referral reports show traffic arriving from your own old domains.
• CDN and server logs show which hostnames still receive requests.

The paper trail

The best inventory is often in accounts payable. Registrar invoices, hosting bills, SaaS subscriptions, and card statements show what someone is still paying for. Marketing campaign briefs, agency contracts, and procurement records show what someone once launched. Check every registrar account too, because larger organizations rarely have only one.

What forgotten properties cost

Accessibility obligations don't expire with attention

For state and local governments, the Justice Department's Title II rule sets WCAG 2.1 Level AA for web content they provide or make available, directly or through contracts and other arrangements. That includes the microsite an agency built for a bond referendum and the vendor-hosted payment portal, not just the main site. For larger governments, the compliance date is April 26, 2027.

The rule's exception for archived content is narrow. The content must have been created before the compliance date, be kept only for reference, research, or recordkeeping, sit in a special area marked as an archive, and remain unchanged since it was archived. A live campaign site with a working form is not an archive. Private businesses have no web regulation with an archive exception to point to, and a demand letter can cite any page that carries the company's name.

Security: dangling DNS and expired certificates

A subdomain takeover starts with a dangling DNS record. Your promo. subdomain has a CNAME pointing at a cloud storage bucket or hosting app. The campaign ends, someone deletes the resource, and nobody removes the record. An attacker who claims the same resource name on that platform can now serve whatever they like at your subdomain: phishing pages, malware, or scripts that read cookies scoped to your parent domain.

The fix is about order. Remove the DNS record before or at the same moment you delete the resource it points to, never after.

Expired certificates are less dramatic and still damaging. Visitors meet a full-page browser warning, and the ones who click through learn to ignore warnings. Lapsed domain registrations are worse: someone else can register the domain and inherit every inbound link and any email still addressed to it.

Brand, search, and privacy

Forgotten pages show old prices, old phone numbers, and old privacy policies. They compete with your main site in search results. And they often still run tracking tags that nobody has reviewed, which is how a site nobody remembers ends up in a privacy complaint. If that last point sounds familiar, read the pixel that fires before your visitor decides.

A decision for every property: keep, fix, merge, redirect, or retire

Ask four questions about each item on your list. Does anyone use it? Does anyone own it? Does it collect data, take payments, or publish information people rely on? Can it meet your standards at a sensible cost?

• Keep a property that is used, owned, and in good shape. Add it to monitoring.
• Fix one that's needed but failing on accessibility, security, or accuracy. Give it an owner and a date.
• Merge content that belongs on the main site. Move the pages people still use, then redirect.
• Redirect when the property is gone but links and traffic remain. Use a permanent redirect to the closest equivalent page, not the home page, and keep the domain registered and its certificate renewed for as long as the redirect runs.
• Retire what nobody uses. Save a copy for your records, remove the DNS records, then shut down the hosting, revoke credentials and API keys, remove its tags, cancel the billing, and decide deliberately whether to keep the domain registered.

The ownership register

The deliverable that keeps this from happening again is a register: one row per property, each with a named owner and a next review date. A shared spreadsheet is enough.

In your own register, put a person's name next to each role, and review the register whenever one of those people leaves.

Start with a list, not a project

This week, pull your certificate transparency results and your registrar and hosting invoices, and put every hostname you find into one spreadsheet. That list alone will tell you whether you have a weekend's cleanup or a real project.

If it's the latter, our Digital Estate Audit finds your domains, subdomains, microsites, documents, and certificates and gives each one an owner and a decision. If the biggest pile turns out to be PDFs, our document accessibility team can help you decide what to remediate, convert, or retire.

Sources

1. U.S. Department of Justice, Final Rule, 89 FR 31320 (FR Doc. 2024-07758)
2. U.S. Department of Justice, Interim Final Rule, 91 FR 20902 (FR Doc. 2026-07663)
3. ADA.gov: Fact Sheet on the Title II web content and mobile app rule
4. W3C WAI: Developing an Accessibility Statement