How They Happen
A business gets a new website and the old one is never switched off; the old domain keeps renewing on a card nobody checks. A developer builds a preview at demo.example.com and never removes it. A business closes, the owner moves on, the hosting bill keeps getting paid. A page builder trial is abandoned with the site still published. None of this is a decision. It is the absence of one, which is Set and Forget carried to its end.
Why They Hurt
They tell customers the wrong thing. The old site has the old phone number, the old hours, the old prices, and it still ranks, sometimes above the new one. Google sees two sites for one business and splits the authority between them.
They get taken over. A site nobody updates is a site nobody patches. Within a year or two it is running an old version of something with a known hole, and it becomes a host for spam pages, a redirect to a casino, or a phishing page using the business's name. The business finds out when a customer asks why their site is selling pills, or when the domain lands on a blocklist and takes the business's email with it. That is Authority Leeching, and a zombie site is the easiest way in.
What To Do With Them
Decide. If the site has anything worth keeping, redirect every old address to the matching page on the new site, so the authority and the bookmarks follow. If it does not, take it down properly: remove the files, remove the DNS records, let the domain expire on purpose or keep it and point it at the real site. A site that is switched off cannot be hacked. One that is merely forgotten can.
How To Check It
Search Google for the business name and read past the first result. Every address that belongs to the business, or used to, should either be the live site or redirect to it. Anything else is a zombie.
The Foundation Connection
A zombie site is Technical Debt with a public address. Active Security in the Digital Foundation means knowing every property the business owns and making sure none of them is standing open.
