Dev, test and staging subdomains outnumber production 15 to 1 across the FTSE 100

Every public company runs more than one website. Behind the marketing homepage sits a second, much larger estate: staging environments, QA rigs, developer sandboxes, and — on some sites — hundreds of short-lived preview builds spun up and torn down by a CI pipeline. Most of it is never meant to be found. Almost all of it still gets a TLS certificate, and every certificate is public.

We pulled 4,161 subdomain hostnames for FTSE 100 constituents from Certificate Transparency logs and direct crawling, then classified each name against a set of plain-text patterns — uat, staging, dev, test, sandbox, and CI-preview conventions like pr-1234. 1,512 names — 36% — matched one of these tags outright.

That ratio isn't really a surprise once you think about how software gets built: a production endpoint is one URL, but getting there involves a dev branch, a QA pass, a staging rehearsal, and — increasingly — an ephemeral environment per pull request. What's notable is how visible that whole pipeline is from the outside, for free, just by watching who requests a certificate.

The breakdown

The CI-preview row is the most concentrated: 180 subdomains across just 10 companies, meaning a handful of engineering organisations are generating ephemeral, per-branch subdomains at real volume — the kind of automatically-named environment (pr-483921, a randomised build ID, a Jira ticket number) that's easy to create by default in a modern deploy pipeline and easy to forget is publicly resolvable, even briefly.

What this does and doesn't tell you

A hostname showing up here means a certificate was issued for that name at some point, or that a crawler followed a link to it from a company's own site. It does not mean the host answers HTTP requests today, that it's misconfigured, or that anything is wrong. Most of these environments are exactly as intended: internal tooling behind a VPN or IP allowlist, using a public CA because that's simpler than running a private one. The interesting signal isn't any single hostname — it's the aggregate shape: how much of a company's real infrastructure footprint sits outside the one URL on its business card, and how much of that shape is visible to anyone who thinks to look.

Full breakdown, methodology, and live numbers: subdomain naming patterns across the FTSE 100.