Building products · September 28, 2026
A gallery plugin from a campaign three years ago
A millwork company's website looked current because the photos changed every month. Underneath, a plugin installed for one 2022 launch was still active and four years out of date.
Illustration, not a client result. The company is invented.
This company is invented, but that forgotten plugin shows up on almost every Site review we run.
A custom millwork manufacturer had a clean marketing website: project galleries, spec PDFs, and a quote request form, with no customer logins. Because marketing updated the project photos every month, everyone assumed the website itself was being maintained.
Three years earlier, a freelancer had installed a third-party gallery plugin for a single trade-show landing page. The landing page was taken down a month after the show. The plugin stayed on the server, four major versions behind, carrying two public file-upload vulnerabilities that automated bots scan for every day.
The review also turned up two smaller items:
- A backup
.ziparchive of the 2023 theme sitting in the web root where anyone could download it. - The quote form was CC'ing submissions to a former sales manager's decommissioned address, which wasn't a security hole but was quietly dropping customer inquiries. We noted it anyway.
The report listed all three items in plain English, ordered by what to fix first, with proof attached. Their web developer deleted the archive, removed the unused plugin, and fixed the form routing in an afternoon. The complimentary re-scan marked every item closed, and the company received its 1-page Letter of Attestation for its annual cyber insurance renewal.