An internal phone script meant only for staff was live as its own public webpage

One page on this site was not a marketing page at all. It was a script, written for internal use, instructing a staff member exactly what to say on a specific kind of sales call, complete with a suggested opening line and bracketed placeholders for a caller's name.

That page was live, publicly reachable, and included in the site's own sitemap, the file websites use to tell search engines which pages exist and should be indexed. Anyone who found it, including a prospective customer doing their own research, could read the business's internal sales playbook in full.

We crawled every URL listed in the site's own sitemap, rather than only the pages linked from the visible navigation, because content like this is almost never linked from a menu and is only findable this way, or by search engines that also read the sitemap directly.

We read the content of every page that surfaced and flagged anything that did not read like customer-facing marketing copy. This page stood out immediately, both from its second-person, instructional tone and from the bracketed placeholder text that no real marketing page would ever include.

A prospective customer who finds a business's own internal sales script sees exactly how they are meant to be persuaded, which tends to have the opposite effect of persuasion. It replaces a natural sales conversation with the sense of being handled according to a formula, at the exact moment trust matters most.

Beyond the trust problem, this kind of leak also hands a direct look at sales tactics to anyone doing competitive research, including competitors themselves, at no cost and with no effort required to find it.

We checked whether the page might have been published deliberately, as an example of transparency about the sales process, by looking for any framing, headline, or disclaimer suggesting that intent. There was none. The page was formatted exactly like an internal training document and nothing else.

We also checked whether the page carried any technical instruction telling search engines to skip it, which would at least limit how easily it could be found even if it stayed live by mistake. No such instruction existed. The page was fully open to being indexed and found through ordinary search.

The page was excluded entirely from the rebuilt site, along with the other internal-only material we found sitting in the same public sitemap, a hiring page and a set of outdated promotional pages that had no reason to remain publicly reachable.

We also put a simple habit in place going forward: before anything gets added to the site, it gets checked against one question, would this be fine for a stranger, a prospective customer, or a competitor to read in full. Internal material gets a private, non-indexed home instead of a public one.

Find your own sitemap file, most sites publish it at a predictable address ending in sitemap.xml, and open every URL listed in it, not just the ones you remember linking to from your menu. It is common to find pages you forgot existed, including some that were never meant to be public in the first place.

For anything you find that looks internal, a script, a staff-only document, an old draft, either remove it from the live site entirely or mark it so search engines are told directly to leave it out of their index. Do not assume a page is safe just because nobody links to it from your navigation.