Software Added With the Host's One-Click Installer

One click, several years ago

Plenty of small business sites started the same way. Someone opened the hosting control panel, found the one-click installer among its icons, chose WordPress or Joomla and clicked install.

A minute later there was a working site with an administrator login. It felt like part of the hosting package, and many owners assumed the host would look after it from then on.

Hosts install; most do not maintain. The software, plugins and themes are usually the account holder's responsibility, and hosting terms tend to say so plainly.

Years later, the account often holds more than one installation, and some of them nobody remembers making.

What the installer did, and did not do

• It copied the software into a folder on your account.
• It created a database and connected the two.
• It set up the first login, often with the username admin.
• It offered update settings, which were often left off.
• It did not update plugins or themes, then or since.
• It did not record why each installation was made.

The last causes the trouble. An installer lists what it put where, but not which copy is the live site, which was an experiment and which was meant to be deleted.

Why the updates never came

On most sites, WordPress now installs its minor security releases automatically, which gives a false sense that everything is looked after. Major versions, such as 4.3 last week, wait for someone to click update.

Plugins and themes do not update themselves unless someone has arranged it. Joomla shows an update notice in its administration area, which helps only if someone logs in to see it.

Some installers can apply updates automatically, but the setting is often off, may cover only the main software, and reaches only the copies the installer still knows about.

So a site can run for years with current core files and plugins from the year it was built.

Finding every installation

Start with the installer's own list, which shows each copy with its address, folder and usually the version installed.

Then look at the account directly, because some copies were made by hand or moved. In the file manager, folders named test, old, new, dev, blog or shop are worth opening.

Check subdomains and any other domains attached to the account, since a second domain added years ago may hold a site of its own.

Finally, the list of databases. Each installation usually has one, so a database nobody can explain often points to an installation nobody remembers.

The copies nobody remembers

A test copy for a redesign that stalled, a shop tried for one season, a gallery from an old event: each is a full installation, public on the internet, frozen at the version it was installed with.

Automated scanners look for exactly these, because old versions have known weaknesses and nobody is watching them.

They also hold old logins. An administrator account made for a designer years ago may still work, with whatever password it was given then.

Shared hosting usually runs everything in an account under one user, so a break-in through a forgotten copy can reach the live site's files in the next folder.

Google may find a test copy too. Searching Google for site: and your domain lists what it has indexed, old copies included.

A worked example

A fabric printer runs a digital textile press in an industrial unit, printing short runs of custom fabric for designers, quilters and upholsterers, and selling sample swatches online.

Its website began as a one-click WordPress install six years ago. When 4.3 came out last week, the owner asked a web developer to look over the hosting account before updating.

The installer listed three installations. The live site had current core files but plugins several years out of date.

A folder called shop held a second WordPress copy with a cart plugin, tried for one autumn and abandoned. A folder called new held a Joomla installation from a redesign never finished.

Neither had been touched since the day it was made, and one still used the username admin. Both were backed up, then deleted, files and databases alike.

The live site's plugins were updated, then the core, after a full backup.

The owner now has a one-page list: one installation, its address, who updates it, how often, and where the backups go.

Deciding who updates each one

Every installation that stays needs a named person or company responsible for updating it, on a schedule they keep.

That might be the owner, with a short routine and someone to call when an update breaks something, or the web developer under a maintenance arrangement.

Some hosts offer managed plans that include updates, but only for what the plan covers.

Write it down: the address, the software, who updates the core, plugins and theme, how often, and how a backup is taken first.

Removing what nobody needs

Deleting an old copy properly takes more than removing a folder.

Take a backup first, in case something in it matters. Then remove the files and the database, through the installer if it still lists the copy, and any subdomain that pointed to it.

Change passwords that were shared between the old copy and the live site. Then search for the old addresses, and have any that still appear in Google removed.

The counter-case

An account with one installation, updated by a developer who checks it monthly, has little to find. The exercise takes ten minutes and confirms what everyone believed.

Some hosts do maintain the software on certain plans. If yours does, get it in writing which installations are covered, and whether plugins and themes are included as well as the core.

For most accounts the advice stands: list every installation, delete the ones nobody needs, and name who updates the rest.

Before the next update

1. Open the installer's list of installations.
2. Browse the folders for test, old and new.
3. Check subdomains and databases for forgotten copies.
4. Back up anything you might need.
5. Delete the copies nobody uses, databases included.
6. Name who updates each remaining installation.
7. Keep the whole list on a single page.

Step five removes the most risk for the least effort. A copy that no longer exists cannot be broken into, and never needs updating again.

Why minor and major WordPress releases arrive differently is covered in three WordPress updates in eight days.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.