Test copies left open on a subdomain get found and indexed, then compete with the real site and show visitors unfinished work. Put every copy behind a password, keep it out of search, and delete copies nobody needs.

Two results for one business

Search for your business name and two results appear for the same home page. One is your site. The other sits at an address beginning with staging or dev, or on your web developer's own domain.

It is the test copy, built during the last redesign so changes could be tried without touching the live site. It looks almost identical.

It also has last year's prices, a page you decided not to publish, and a contact form that sends enquiries wherever they went during testing.

Nobody meant it to be public. It was meant to be temporary, and temporary copies tend to outlive the projects they were made for.

How Google finds a copy nobody linked to

The first rarely gets checked after launch. Content written on the test copy often carries the full test address in every link and image, and those addresses move to the live site with it unless somebody replaces them.

What an open copy costs

Google sees two near-identical versions of each page and chooses one to show. It does not always choose yours, and the test page can appear in place of the real one or beside it.

Visitors who land there see unfinished pages, old prices, staff who have left and services you dropped.

Forms on the copy often still work. Enquiries go to the developer's test inbox, an old address or nowhere, and the visitor believes they have been in touch.

A store's copy may even have a checkout in test mode, accepting orders that are never charged and never shipped.

The data inside the copy

A copy of a website is usually a copy of its database too: customer accounts, past orders, form entries, newsletter subscribers. For a store or a membership site, that is personal information at a second address.

Privacy law treats that copy like the original. The business is responsible for protecting it, and a copy nobody remembers is a copy nobody is protecting.

Copies can also act on that data. A store's copy with its scheduled tasks still running can send order emails or renewal reminders to real customers, from a site everybody thought was switched off.

A password, not a polite request

The reliable way to keep a copy private is a password set at the server, so a box asking for a username and password appears before any page loads. On cPanel hosting it is called Directory Privacy.

It keeps out search engines and people alike, it costs nothing, and it takes a few minutes.

WordPress's setting to discourage search engines is different. Well-behaved crawlers generally respect it, but it does nothing to stop a person with the address, and it does not reliably remove pages already listed.

It also has a habit of travelling. Copied to the live site at launch, it quietly asks search engines to ignore the real business.

A worked example

A self-storage business in Burnaby had its website rebuilt last year. The developer worked on a subdomain of the company's own domain, launched the new site in the spring, and moved on.

The copy stayed online with no password and nothing asking search engines to stay out. Several unit pages on the live site still linked to it, because they had been written there.

Google followed those links, and the copy's unit pages began appearing in search results with the previous year's monthly rates.

The company found out when a customer called to rent a unit at an old rate, quoting the page, and another mentioned a reservation request nobody had answered. It had gone to the developer's test inbox.

The developer saved a final backup, then deleted the copy and its subdomain. The live site's links were corrected, and the old test addresses now return a not found error.

The next test copy will sit behind a password from its first day.

Telling search engines to stay out

A password is enough on its own, since search engines cannot read what they cannot open.

Where a copy has to be reachable without one, add a noindex robots meta tag to every page, or have the server send the same instruction as a header.

Since the first of this month, Google no longer follows noindex lines in robots.txt, so that shortcut is gone. And a Disallow line alone stops search engines reading the pages, not listing their addresses.

When the copy is already in Google

Close it first, with a password or by deleting it. Once the pages stop loading, Google drops them as it revisits.

Search Console's removal tool hides the addresses quickly in the meantime, once the copy's own address is verified there. If the copy lives on the developer's domain, they have to do this part.

Then correct the live site's links to the copy, or they will keep leading search engines and visitors to an error.

Copies nobody needs

After launch, most test copies have no further job. Keep a final backup offline if anybody wants one, then delete the copy, its database and its subdomain.

Copies that stay, for trying updates before they go live, belong on a short list: the address, its purpose, who maintains it, and when it was last checked.

The counter-case

Test copies are good practice. Trying changes on a copy before the live site prevents far more problems than it causes, and nothing here argues against them.

A copy behind a password causes none of these problems, wherever it sits, and neither does one that existed for an afternoon. A site that has never been redesigned or copied may have nothing to find.

Otherwise: lock every copy with a password, keep it out of search, and delete it once its job is done.

The check

  1. Search your business name for duplicate results.
  2. Ask your developer which copies exist and where.
  3. List the subdomains on your hosting account.
  4. Password-protect every copy you keep.
  5. Delete the copies nobody needs.
  6. Fix live links that point at test addresses.
  7. Remove indexed copies through Search Console.

Step two is the one that finds what a search will not. A copy on the developer's own domain never appears in your hosting account, and only the person who made it knows the address.

Test copies are one more thing your hosting account carries, alongside the mailboxes covered in email on the same server as your website.

Frequently asked questions

How does Google find a test copy?

Usually through links: pages on the live site still pointing at the test address, images loading from it, a submitted sitemap, or a link shared publicly somewhere.

What harm does an open test copy do?

It competes with your real pages in search, shows visitors old prices and unfinished work, and its forms may send enquiries to a test inbox nobody reads.

Is the WordPress setting to discourage search engines enough?

No. Well-behaved crawlers generally respect it, but it does not stop people with the address, and it does not reliably remove pages already listed.

What is the safest way to protect a copy?

A password on the whole copy, set at the server, so nothing loads until a username and password are entered. It keeps out search engines and people alike.

Why does a test copy raise privacy issues?

A copy usually includes the site's database, with customer accounts, orders and form entries, and privacy law treats it like the original.

How do I remove a copy already in Google?

Close it with a password or delete it, use Search Console's removal tool to hide it quickly, and fix any live links that still point at it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Two copies of your site in Google?

Tell us your domain. We will find every copy, lock the ones you keep and remove the rest.

Start a Conversation