What happens when you don’t patch a website for 5 years?

I left a website abandoned for 5 years, no updates, no monitoring, and no maintenance, here’s what happened.

How this website began.

A couple of years ago I was in a pretty big Minecraft phase, so I set up my own multiplayer server for my friends and I to play together.

The goal was to eventually make it a public SMP that anyone can join, so I spent a lot of time hardening the server and preparing it for a community to come on in.

I wanted a website to use as a place for people to chat and share content from their builds and whatnot, as well as manage roles/ranks/accounts, a forum seemed like a great solution here.

I did a lot of research and ended up settling on Xenforo, one of the biggest players in the forum space, I spent nearly $300 on a starter license and began working on my site.

Building out the website.

I spent a few days customizing Xenforo, finding a good theme, branding everything, adding embeds and custom HTML around the place.

This is what the homepage ended up looking like:

I also spent a long time building out the forums structure, creating different categories and customizing navigation.

One of the more random things I did was set up different news sections that automatically repost news from several different sources under new discussion threads.

This gave the forum some extra signs of life and helped get conversations started (or so I thought).

blank

Launching the site.

I never really did an official site launch.

I remember I had issues with a plugin called Minesync that I couldn’t get working the way I wanted to, so I never fully integrated the forum users with my Minecraft server.

The original goal was to have users register on the forum to get perms on the Minecraft server, but that didn’t seem possible with the options available to me at this point.

I told myself I’d come back to working on the forum later, maybe as the Minecraft server grew, but in reality there was a bigger problem around this time.

Discord had heavily replaced the need for forums.

As people started asking for more channels and integrations in my discord server I quickly realised that there was little chance I’d be able to transition players from Discord over to forum users.

My Minecraft community lived in Discord now, and honestly, it made a lot of sense to, it integrated really well.

I also never got around to marketing the Minecraft Server or the forum properly, I played on it a little, but I certainly wasn’t posting on server lists or making regular content about the server.

My Minecraft phase faded away pretty soon, and I got busy with work/study so had to take a step back.

And so the website sat there, sitting abandoned, with nothing but automated news posts and YouTube links to keep it alive.

The first signs of trouble.

Initially things were pretty quiet, but after a few weeks my site got indexed on Google and began showing up in search results.

Not long after that I started to see a lot of spam registration attempts clogging up the approval queue, even though I had spam mitigations setup.

If I approved any of these users, they would immediately update their profile and begin creating posts linking to gambling websites or other paid content.

I decided to close registrations in the meantime, as there were very few legitimate users discovering the forum.

The errors that wouldn’t stop.

One day I checked in with the site again and noticed that there were a lot of error events in the logs, I had a deeper look and discovered that my theme was no longer compatible with my Xenforo version, causing all these template errors.

At this point though, I was hard set on not spending more money on the site (especially just to update a theme), particularly when the websites functionality was still fine.

Eventually this became a problem though, as the error log filled up the database with junk, over 2GB worth, which was bringing things close to the disk limit of my cheap web hosting service.

So I just deleted the errors table from the database.

Aside from the giant warning in the admin panel above, everything kept chugging along, I was now able to continue neglecting the forum even more.

The Flood

With registrations closed there was little that could really go wrong, people could no longer post malicious content or advertise, so the only real risk was any exploits with Xenforo as it started to fall behind on patches (I only had updates for 1 year).

I was looking at the site recently, for the first time in years, and I noticed I was serving over 7 Million requests a month!

blank

That didn’t really make sense, there shouldn’t really be much traffic on the site, let alone 56,000 visitors.

For the fun of it, I thought why not make the most of this unexpected traffic and throw some ads up, maybe it’ll help pay for hosting until I get round to looking at the site next.

I went into Google AdSense and configured the maximum amount of advertisements possible, just to see what would happen.

I checked in a month later and the results were…. surprising.

Apparently, my 56,000 unique visitors only equated to about 82 real impressions, and I made a whopping $0.03, wow!

It became pretty clear at this point that my site was being flooded by bots, which were likely scraping all the reposted news content thinking it was unique (which it wasn’t).

The reality was there was very little actual content on my forum that couldn’t be found elsewhere, even the few posts I made myself were mirrored to Reddit (or similar sites) for visibility.

I needed to make a decision.

At this point, there was significantly more traffic on this site than the blog you are reading right now, and most of this was just due to running an ancient Xenforo version that bots loved.

blank
A better overview of the traffic I was seeing.

Many bot mitigation features were also just never enabled in Cloudflare because I genuinely hadn’t looked at it for years.

The thing is though, bots don’t just scrape websites, they constantly attack them, trying common exploits, exposed logins, all sorts of things.

All of this traffic was actually starting to affect this blog (as it was sharing the same web server as the forum), this had a real performance impact and a potential security one now as well.

I really needed to give the site some attention, or just… let it go.

I didn’t have the motivation to keep working on the forum, it didn’t have any registered users, and I would absolutely need to spend more money to re-license and patch Xenforo if I wanted to promote or even rebrand the site.

I decided to archive and shut down the forum, indefinitely.

And almost immediately, the bot traffic completely went away.

blank
Can you guess when I shutdown the site?

Why didn’t I do this sooner?

The main reason would be because I had a few different forum pages linked on my Minecraft server, things like the live world map, resource pack downloads, guides, all these things lived there.

Recently however I took down the Minecraft server for a few weeks as I was doing a migration to Proxmox from Hyper-V, which went well actually, but I never got around to redeploying my Minecraft VM (since I wanted to update/rebuild it… eventually).

With expiration of my old domain coming up soon as well (and it’s bad reputation because of all the bot spam), I’ve decided not to renew it and shift everything over to chrispro.tech instead.

All in all, this was probably the best time to archive the forum as there was virtually no impact, compared to the past where a handful of people relied on it for resources.

The other thing was that at the time, my YouTube channel revenue was easily covering the forum and Minecraft Server hosting fees, and keeping them running felt like one of the best ways to give back to my community.

What did I learn from this?

Well, I think my biggest lesson, is that investing into a premium forum solution right as Discord was already taking over was not a great idea, although I did definitely learn a lot when setting it up!

The second thing, is that a lot of the web traffic out there really is just bots trying to scrape your site, and page views are not really guaranteed to be from humans.

Some of you might remember as well that I initially decided to build this blog on the same domain as the forum (well under a subdomain of it).

This actually was a pretty big problem because of the poor reputation of my site and my domain, it prevented all my blog posts from being indexed by google entirely, which is why I moved this blog over to chrispro.tech.

In the end though, ChrisProTech lives on and the old domain (which I shall not name going forward) will be auctioned off by my domain registrar, for anyone to purchase.

For those that were active on the forum, you can reminisce by browsing parts of it on archive.org (if you remember the domain), as for everyone else, feel free to check out my other posts here!

Cheers,

Chris

🙉 Wanna know when I post?

I don’t spam! – Just one email, every once in a while, when there’s a new post.

Sharing is caring!

Comments

Note: any comments identifying companies or individuals discussed above will not be approved.

Leave a Reply

Your email address will not be published. Required fields are marked *