Security tip 12 · Clear out
Clear out what nobody uses.
The most dangerous thing is rarely what you look after. It is the forgotten port, the old test site, the app with access to your email and the domain that expired. One round a year closes most of it.
Last checked 1 November 2026
Short answer
Once a year: close forgotten ports and UPnP in the router, delete old DNS records, check when domains expire, remove apps and services you have given access to your account, and switch off old servers and devices nobody uses.
- Time
- ~1 time once a year
- Price
- Free
- Covers
- Network, domains, accounts
- Needs
- Access to router and accounts
Why
What is forgotten does not get updated.
Everything you use gets looked after: updates arrive, and someone notices if it stops working. What nobody uses any more gets no updates and no attention – but it is still waiting on the network, with the holes it had when it was forgotten.
Attackers love what is forgotten, because nobody notices when it is taken over. Many of the ports Shodan Monitor finds are exactly that kind.
The rule
If nobody can explain what it is and who uses it, switch it off and wait a month. If nobody complains, delete it.
The round
Seven places to look, about an hour.
Ports in the router
Go through port forwarding in the router. Every rule must be explainable: what, who and why. Also switch off UPnP unless you know something needs it – it lets devices open ports themselves, without anyone asking.
Old DNS records
Look through the list of DNS records. A record pointing to a server or service you no longer have can at worst be taken over by someone else, who then has a page under your domain. Delete what nobody can explain.
Domains that expire
Switch on automatic renewal on every domain you use – including those only used for email. An expired domain can be bought by others, who then receive email to your old addresses. Old domains that have been used for email are often worth keeping and locking (tip 6).
Apps with access to the account
In the Google account, the list is under Security → Your connections to third-party apps & services (Google’s guide). Microsoft and Apple have similar lists. Remove the apps you do not use – they still have access even though they are forgotten.
Devices and sessions
Email accounts and most big services show which devices are signed in. Sign out the old phone, the sold computer and the borrowed iPad.
Users who have left
Close accounts for people who have left – and change the shared passwords they knew. Do not forget the Wi-Fi password, the alarm and the services shared on one account.
Old servers and test sites
The old NAS, the test site from the last project, the virtual machine that just keeps running. Switch off or delete what has no owner. What stays must be updated.
Put it in the calendar
Once a year. Same day.
Pick a fixed day – e.g. the first Monday in January – and put a recurring appointment in the calendar with the link to this page. Write down what you found, so the next round is quicker.
Combine with the tips that keep watch in between: Shodan Monitor for ports, Certificate Transparency for certificates and Have I Been Pwned for leaked addresses.
Honest about the limits
- No tool finds it all. What is forgotten is exactly what is not on any list. Also ask colleagues and family: "What have you set up that I do not know about?"
- Switch off before you delete. Something that looks forgotten may be what the alarm or the bookkeeping uses. Hence the rule of waiting a month.
About this tip
The round is the one the man behind Wi24rd walks himself for his own domains and networks. The path to Google’s list was checked in Google’s guide on 1 November 2026.
The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services.
Missing a tip?
Write what you would like explained. The next security tip could be yours.