Checking Your Own Public Footprint Part 6: Closing the Gaps You Just Found

Parts 2 through 5 find things. This part closes them, in roughly the order you’re likely to have found them.

Registrar privacy, generally

Most registrars call this WHOIS privacy, domain privacy, or ID protection, and most either enable it by default now or offer it as a one-click toggle in the domain’s management panel. It’s worth checking explicitly rather than assuming, for two reasons covered in Part 1: a registrar transfer can silently reset it, and organisation-type registrations often can’t use it at all, by design, regardless of the registrar.

The Nominet individual opt-out specifically

If you registered a .uk domain as an individual and Part 2’s WHOIS check showed your address in full, the fix lives with your registrar’s control panel, not with Nominet directly, though the effect appears in Nominet’s public WHOIS record. Look for a “Registrant Type” field, set to UK Individual or Non-UK Individual, and an adjacent opt-out option, usually phrased as something like “keep my details private” or “opt out from having my details publicly available.” Nominet’s own guidance states changes are reflected in the WHOIS output within 24 hours. This option is only available for personal registrations; a domain registered to a business or used for commercial purposes doesn’t get it, which is a deliberate policy choice, not a gap.

Requesting removal of a stale archive

If Part 5’s Wayback Machine check turned up an old snapshot from before your privacy setting was correct, or from a registrar you’ve since left, the Internet Archive does take removal requests, though they don’t guarantee an outcome ahead of time. Two routes:

Email. Send the specific URLs you want reviewed to info@archive.org, along with the time period during which you controlled the domain or account in question, and enough context for their team to understand the request. This is the right route for a specific stale page, which is almost always what you’re dealing with here.

robots.txt. If the exposure is coming from a domain you currently own, adding a User-agent: ia_archiver Disallow: / block to that domain’s robots.txt removes all of that domain’s snapshots from the Wayback Machine’s public interface going forward. This only works for a domain you control right now; it can’t be used to affect someone else’s site, and it doesn’t retroactively help with a snapshot hosted on a third-party WHOIS lookup site, which is the more common case from Part 5’s technique.

Deleting the accounts Part 3 turned up

For anything Maigret flagged that turned out to be real and genuinely yours, and stale: actually delete it rather than abandoning it. A deactivated-but-not-deleted account is still a data point tying that username to that service, still indexed, still potentially still holding whatever personal information you gave it when you signed up. justdeleteme.xyz keeps a crowd-sourced list of direct deletion links and difficulty ratings per service, which is faster than hunting through each site’s own settings menus individually.

General hygiene, done once rather than per finding

A handful of changes are worth making as standing practice rather than reacting to each individual audit result:

Use a distinct username for anything genuinely sensitive, separate from the handle you use for public-facing, professional accounts. The value of Part 3’s exercise drops sharply if every account in your life shares one identifier, because a single leak or a single correlated search then reaches everything at once.

Use a password manager and unique passwords per service, so Part 5’s breach check stops being an emergency response and becomes a routine one: one compromised service doesn’t cascade into every other account you hold.

Enable two-factor authentication wherever it’s offered, particularly on the email account tied to your domain registrations, since that inbox is usually the recovery path for everything else.

Treat this whole series as a repeat check, not a one-time fix. Part 1 opened on the point that none of this is static. A registrar transfer, a new certificate, a new account signup: any of them can reopen something you already closed. A rough cadence of once or twice a year, or immediately after anything like a registrar transfer, is enough to keep the gap small.

Part 7 closes the series with the tool that automates most of Parts 2 through 5 in a single pass, and where it still falls short of doing this by hand.