Website scanning and probing

Scanning, or probing, is when an automated tool requests a long list of well-known addresses on your website to see which ones exist: admin panels, configuration files, backups, version-control folders and test pages. It is usually the step before a real attack.

This page is about probing of web addresses. It is not about network port scanning, which happens below the level of your website.

1. The attacker, or more often a bot, picks a target, often thousands of sites at once.
2. It requests addresses such as /.env, /.git, /wp-login.php, /phpmyadmin, /backup and /server-status.
3. Any address that answers with something other than "not found" is noted as a lead.
4. Leads are then attacked: guessing passwords on an admin page, downloading an exposed configuration file, or exploiting an out-of-date plugin.

• Many requests for pages that do not exist, in a short time, from one IP address.
• Requests for files you never published, such as .env, .git or backup archives.
• Requests for admin addresses of software you do not even use.
• A rise in 404 responses in your logs.

• Exposed configuration or backup files can leak passwords and keys directly.
• Forgotten admin or test pages become entry points.
• Probing tells the attacker which software and versions you run.
• It often comes before brute-force or injection attempts.

• Remove, or put behind a login or IP limit, admin panels, staging pages and test files you do not need.
• Never leave .env, .git, database dumps or backups reachable from the internet.
• Keep your CMS, plugins and server software updated.
• Hide version numbers and detailed error messages.
• Return the same plain response for missing pages and restricted ones.
• Block addresses that request many non-existent pages in a short time.

Not sure how your own site looks from outside? Run the free website security scanner.

Rakshak raises a scanning alert in two cases. First, a request for a well-known sensitive address, matched by path segment: for example /wp-admin, /wp-login.php, /xmlrpc.php, /.env, /.git, /.aws, /phpmyadmin, /backup, /server-status, /cgi-bin and /actuator.

Second, one IP address requesting many different addresses within a couple of minutes.

• Every detection creates an alert in your Rakshak dashboard with the IP address, the request that triggered it, the severity and the time.
• If you have connected Telegram, Rakshak also sends you a message. You choose which severities you want to be told about.
• Repeated alerts of the same type from the same IP address are grouped for ten minutes, so you are not flooded with duplicates.
• Website scanning and probing is a high-severity detection. It raises an alert but does not block anyone automatically, because it can also come from harmless visitors. You review it and, if you agree, add the IP address to your blocklist on the IP management page.
• Blocking needs the Rakshak server middleware on your website. The lightweight browser snippet can detect and alert, but a browser script cannot block a visitor.

A website runs on a framework that keeps secrets in a .env file. A bot requests /.env, then /.git/config, then /backup, hoping one of them is public.

Rakshak raises a high-severity scanning alert for the first sensitive address, with the IP address and the request. The owner checks that none of those files can be downloaded and blocks the address.

Even if every file was safe, the owner now knows the site is being probed and keeps software updated.

GET /.env
GET /.git/config
GET /phpmyadmin/

Is every request for /admin a scan?

No. It can be you or your team. Rakshak treats the request as probing because attackers use the same address, so you may see alerts for your own visits. You decide whether to act.

Why is scanning detection not blocked automatically?

A single request to a listed address can be harmless, so Rakshak alerts you first. You can then block the IP address if it is clearly hostile.

Does this detect port scans?

No. Port scans happen at the network level. Rakshak looks at requests made to your website's addresses.

What should I do if my .env file is reachable?

Remove it from the public folder immediately, then change every password and key stored in it, because it may already have been copied.

Does a lot of 404 traffic mean I am being attacked?

Not always, because broken links and search engines cause 404s too. A burst of 404s from one address, aimed at sensitive paths, is the pattern to worry about.