View Old Versions of Websites, and What They Keep About You

On January 5, 2022, the German tabloid Bild reported, in print and on its website, that a well-known singer had given birth at home. It wasn’t true. The baby had been born in a hospital. The singer sued. But by then other people had copied the article, among other places into the Wayback Machine, the huge web archive that lets anyone view old versions of websites.

A Berlin appeals court shrugged at those copies. Search engines don’t index them, it reasoned. Germany’s Federal Court of Justice disagreed on March 31, 2026 (case VI ZR 157/24). The copies could still be pulled up with a targeted search. In the court’s words, in our translation: “This is sufficient to affirm a continuing impairment of the general right of personality.” The publisher now has to push for removal from the archived copies too.

That is a German court and an unusual case. The principle reaches much further. Did you ever run a website, sit on the board of a club or appear on a company’s team page? Then a copy of that may well still be around. This piece covers what those copies can reveal, how to check your own, and how to get something taken down.

What the Wayback Machine actually is

The Wayback Machine belongs to the Internet Archive, a San Francisco nonprofit that Brewster Kahle founded in April 1996. That October its first crawlers went out. These are programs that request web pages and file away a copy. Back then, the Archive says, the whole web came to about 2.5 terabytes. The collection went public in 2001. On October 22, 2025, it passed one trillion saved web pages.

Using it is easy. Type an address into web.archive.org and you get a calendar. Each highlighted day marks a saved copy. Click one and the page loads as it looked back then, usually with images intact. For most people that is a pleasant trip to a first homepage or a band site from 2006.

Two things matter more here than the size. The Archive collects on its own, without asking you. And anyone can add to it.

Save Page Now: anyone can preserve a page

At web.archive.org/save there is a simple form. Paste in an address and the Archive makes a copy on the spot, with a permanent link. It saves that one page and its images. One sentence from the help page is worth reading twice: “We do not keep your IP address, so your submission is anonymous.”

Reporters love this, and for good reason. On July 17, 2014, the separatist commander Igor Girkin posted on the Russian network VKontakte that his men had “just downed a plane” near Torez in eastern Ukraine. He called it an AN-26 military transport. Then it became clear the aircraft was the passenger jet MH17, and the post disappeared. The Wayback Machine had a copy, timestamped 15:22 GMT. A guest post on the Library of Congress blog later reported that the post was live for about three hours. The copy came from an unknown person using Save Page Now. The Christian Science Monitor cited it the same day.

Now turn that around. Whether a page of yours ends up in the archive does not depend on a crawler alone. Anyone curious about it can freeze it with one click. They leave no trace.

archive.today, the other archive

There is a second big service, archive.today, also reachable as archive.ph and archive.is. It works much like Save Page Now. Its FAQ says each copy is kept “virtually forever.” For the people in those copies, its rules are far less friendly. More on that below.

What old versions of your site may still show

People like to say the internet never forgets. Often that is an exaggeration, since plenty of pages vanish without a trace and old links die all the time. For anything the archive did capture, though, the saying holds up well. Whatever you changed or deleted on your site is gone only from the current version. The older copies stay, each with a date.

That can add up. The contact page of a small business from the years when the owner worked out of their house and listed the home address. A youth soccer league site with coach names, cell numbers and, in the downloads folder, a roster. A team page with photos and names of people who left years ago. Job ads that spell out which software a company runs. And PDFs, lots of them: price lists, meeting minutes, forms, kept along with their document properties.

None of this happened against your will. The archive shows what you once published yourself. It becomes a problem when someone reads it with intent.

How attackers read the past

Security professionals treat web archives as standard equipment. OWASP, a nonprofit foundation focused on web application security, publishes a widely used testing guide that companies hire testers to follow. In the current development version of that guide, section WSTG-INFO-01, the Wayback Machine is named as a research source. Testers, it says, commonly automate the collection of historical URLs from archives, and those URLs “frequently reveal forgotten endpoints, old API paths, backup files, and parameters that are no longer linked from the live application.”

The same section lists what this kind of research tends to surface: archived posts and emails by administrators, login procedures and username formats, and at worst usernames, passwords and private keys. What a hired tester can find, an attacker without a contract can find just as well.

In everyday terms this is not dramatic. An old staff page shows that a company’s email addresses follow the pattern first.last, and a name from today’s website then gives a phishing email a believable recipient. A former employee still listed on a 2019 page supplies a name to drop on a phone call to the front desk. The number from an old contact page may ring the same person years later. How such scattered pieces add up to a full profile is the subject of our piece on OSINT.

robots.txt is not a hiding place

Many websites carry a file called robots.txt that asks search engine crawlers to skip certain areas, such as /internal or /backup. The file is public, though, and gets archived like everything else. The Internet Archive itself noted in 2017, in a parenthetical, that “malicious actors have also used robots.txt files to identify those same sensitive areas.” The OWASP guide puts it more flatly: robots.txt “should not be considered as a mechanism to enforce restrictions on how web content is accessed, stored, or republished by third parties.”

An old robots.txt in the archive is a list of folders someone once wanted to keep out of sight. Some of those folders still exist.

View old versions of websites to check yourself

Whatever an attacker can see in the archive, you can see too, and it takes about half an hour. Looking up your own domain, your club or your old blog raises no ethical question at all. Those are your pages.

Start with the domain. Enter it at web.archive.org and note when the oldest copies were made. Then jump to the years before a move, a redesign or a change in leadership, because the versions right before a big change tend to be the most detailed.

Next, the subpages that usually hold personal details: contact, about, team, board, downloads, press and careers. Enter the full address of each one, such as example.com/contact, instead of only the home page.

PDFs deserve a second look. Open the archived file and check its document properties, not only the text. Author name, company and the software used are often sitting there in plain view. We walk through what hides in those fields in our piece on what your files reveal.

The same works for old profile pages and for pages other people made about you, like a feature in a local paper or a bio on a former employer’s site. While you are at it, check what search engines show today as well. Our guide to Google dorks covers the search commands that make that quick.

Some of this you fix on your own server, not in the archive. A forgotten folder that still answers today needs to be shut, whatever the archive shows.

Remove a website from the Wayback Machine

With the Internet Archive there is an official route, and it is less bureaucratic than you might expect. According to its help page “Using the Wayback Machine,” you email [email protected]. Include the URLs in question, the time frame you want excluded, the period during which you controlled the site or account, and anything else that supports the request.

The Archive is candid about what happens next: “This will initiate a review by our team. We do not make any guarantees beforehand about the outcome of a request.” Since it asks about the period of your control, anything that shows the site was yours helps, such as writing from an address on the same domain. A list of exact URLs gets further than a line asking to delete everything.

It gets harder when someone else published the material, say a news story or a blog post about you. Then you are not the site owner, and all you can do is explain why the copy harms you. The archive decides, and it promises nothing in advance. The German ruling above shows a different approach: there, the court put the duty on the publisher who spread the false claim, which now has to contact the archive and ask for removal once the person affected names the URLs.

Why robots.txt is not the delete button

For years a simple trick worked. Add a rule to robots.txt that blocked the Archive’s crawler, and the old copies would usually disappear from view too. On April 17, 2017, Mark Graham, director of the Wayback Machine, announced a change of course. Robots.txt files were written for search engines, he argued, and did not fit an archive. One recurring headache was the parked domain: when a lapsed site turned into a parking page with a new robots.txt, its entire history vanished from the Wayback Machine. The Archive had already stopped honoring robots.txt on US government and military sites and said it was looking to do this more broadly.

How far that went in practice, the Archive does not spell out. Its current help pages mention robots.txt only as a possible reason why a site was not crawled. The one active route they name for getting something out is the email to [email protected]. Anyone relying on robots.txt is betting on a promise the Archive no longer makes. And a page someone saves by hand through Save Page Now never went through a crawler in the first place.

archive.today: honestly, very little

The picture at archive.today is simple and not encouraging. Its FAQ says pages may be deleted if they violate the hosting provider’s rules, with cracks and porn as examples, or if they are completely empty. Asked about outdated or inaccurate information, it answers that it is not a news agency and merely certifies that a given page existed at a given point in time, which “is not the reason to burn the books.” It also ignores robots.txt, saying it acts as a direct agent of the human user who asked for the copy.

Nobody knows for certain who runs it. Ars Technica, a technology news site, reported in November 2025 that the FBI had sent a subpoena dated October 30, 2025, to the domain registrar Tucows, seeking information on the customer behind archive.today. The service posted the document itself. In February 2026 the same publication reported that English Wikipedia had moved to blacklist archive.today, citing among other things evidence that its operators had altered the content of archived pages.

So a removal there is close to impossible to enforce, and a copy there proves less than the word archive suggests. If you find something false about yourself on archive.today, the original source and whoever keeps sharing the copy are the more realistic places to push.

When the archive itself is breached

Anyone with an Internet Archive account, maybe to save pages or borrow books, has handed the Archive data of their own. In the fall of 2024 that became very concrete.

On October 9, 2024, visitors to archive.org saw a pop-up the Archive had not put there. The attacker mocked the Internet Archive as running “on sticks” and announced that 31 million users would soon show up on Have I Been Pwned, a service for checking whether an email address appears in a data breach. Its operator, Troy Hunt, had received the file nine days earlier, according to the security news site BleepingComputer: 6.4 gigabytes with email addresses, screen names and passwords stored as bcrypt hashes, a scrambled form that is not plain text. Have I Been Pwned lists 31,081,179 affected accounts, with the newest record dated September 28, 2024.

At the same time, denial-of-service attacks knocked the site offline. A hacktivist group claimed them, and BleepingComputer judged it probably unrelated to the data theft. Brewster Kahle confirmed the attacks and the breach on X. On October 20 a second incident followed, this time through the Archive’s support system.

If you ever had an account there, run a quick check. Our guide to checking for a data breach explains how to do it safely and what to do with a hit. The password you used back then should not be in use anywhere today.

What it comes down to

The Wayback Machine is one of the most valuable things the web has produced. It has rescued evidence that would otherwise be gone, and by the Internet Archive’s count more than 100 news articles a month cite or rely on material preserved there.

The same quality has a downside for anyone who ever published anything. A deleted page is, at first, deleted only from your own server. Knowing that makes it manageable. One evening is enough to go through your own domain in the archive, including the old contact page, the club site and the staff list. What should no longer be there goes to [email protected] with exact URLs. And for whatever goes online next, it helps to remember that it may outlast the website it was posted on.

For the wider picture of why deleted rarely means gone, from hard drives to cloud accounts, see our guide on how to really delete data.

Frequently asked questions

How do I view old versions of websites?

Go to web.archive.org, the Wayback Machine run by the nonprofit Internet Archive, and type in the address. You get a calendar in which every highlighted day stands for a saved copy. Click one and the page opens the way it looked on that date, usually with images and layout. For pages deeper in a site, enter the full address, for example example.com/about, rather than just the home page.

Why is a page missing from the Wayback Machine?

Gaps are normal. The Internet Archive's own help page lists the usual reasons: the page was behind a password, a robots.txt file kept the crawler out, it was otherwise unreachable, or the site owner asked for it to be excluded. Pages that were only online for a short time may also have been missed simply because no crawler came by.

How do I remove my website from the Wayback Machine?

Send an email to [email protected]. According to the Internet Archive's help page, include the URLs, the time frame you want excluded, the period during which you controlled the site or account, and any other information that supports your request. The Archive will review it, but says plainly that it makes no guarantees beforehand about the outcome.

Does robots.txt keep my site out of the Wayback Machine?

Do not count on it. In 2017 the Internet Archive announced it would rely less on robots.txt, a file designed for search engines. Its current help pages mention robots.txt only as one possible reason a site was not crawled, and anyone can still save a public page by hand through Save Page Now. The OWASP testing guide states that robots.txt is not a mechanism to control how third parties store or republish content.

Can I get a page removed from archive.today?

Realistically, almost never. The archive.today FAQ says pages may be deleted if they break its hosting provider's rules or are completely empty, and that outdated or wrong information is no reason to burn the books. There is no published removal process, and the operator is anonymous. Your better lever is usually the original source and whoever is spreading the copy.