What I found
- Automated requests searching for .env files.
- Attempts to access .git directories.
- Probes for WordPress login pages and other common targets.
- Suspicious requests appearing without any publicity for the site.
What I learned
- Internet-facing servers are constantly scanned.
- Most of these requests are automated rather than personally targeted.
- An HTTP 200 response doesn't necessarily mean a sensitive file was exposed.
The takeaway
← Back to the build diary
A website doesn't need human visitors to attract automated scanning.