---
title: 404 scanning
canonical: https://wpsecurityninja.com/dictionary/404-scanning/
---
# 404 scanning

404 scanning is automated probing of missing URLs to find leftovers, backups, and known vulnerable paths.

[Full guide](https://wpsecurityninja.com/404-hammering/)

## Why it matters for WordPress

Bots do not only hit the homepage. They request thousands of paths that never existed: old plugin folders, `.env` backups, `wp-config.php.bak`, known exploit URLs. Each miss is a 404 that still costs PHP or server work. On cheap hosting, that noise shows up as slow sites and higher bills.

## How it shows up in practice

- Access logs full of 404s for random PHP filenames
- Spikes right after a popular CVE hits the news
- Hosting panels warning about bot traffic or resource limits
- Scanners looking for leftover zip backups in the web root

## What to do

1. Do not leave backup zips, `.sql` dumps, or `wp-config` copies in public directories.
2. Block or challenge the noisiest probe patterns at the firewall or host edge.
3. Keep plugins updated so “known path” exploits fail even when probed.
4. Watch whether 404 storms hide a quieter successful intrusion elsewhere.

## In WP Security Ninja

[404 Guard](https://wpsecurityninja.com/404-guard/) helps cut scanners that hammer missing URLs. [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) can block known-bad IPs and exploit-shaped requests before they chew through workers. Deeper context: [why 404s spike hosting bills](https://wpsecurityninja.com/404-hammering/).