---
title: 404 scanning
canonical: https://wpsecurityninja.com/dictionary/404-scanning/
---
# 404 scanning

404 scanning is automated probing of missing URLs to find leftovers, backups, and known vulnerable paths.

Last updated: 2026-08-26

Also called: 404 hammering, 404 probe, vulnerability scanning

## Related terms

- [DDoS](https://wpsecurityninja.com/dictionary/ddos/): A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.
- [WordPress WAF](https://wpsecurityninja.com/dictionary/waf/): A WAF filters HTTP traffic to block common web attacks before they reach WordPress.
- [Rate limiting](https://wpsecurityninja.com/dictionary/rate-limiting/): Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- [Vulnerability](https://wpsecurityninja.com/dictionary/vulnerability/): A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.

[Full guide](https://wpsecurityninja.com/404-hammering/)

## Why it matters for WordPress

Bots do not only hit the homepage. They request thousands of paths that never existed: old plugin folders, `.env` backups, `wp-config.php.bak`, known exploit URLs. Each miss is a 404 that still costs PHP or server work. On cheap hosting, that noise shows up as slow sites and higher bills.

## How it shows up in practice

- Access logs full of 404s for random PHP filenames
- Spikes right after a popular CVE hits the news
- Hosting panels warning about bot traffic or resource limits
- Scanners looking for leftover zip backups in the web root

## What to do

1. Do not leave backup zips, `.sql` dumps, or `wp-config` copies in public directories.
2. Block or challenge the noisiest probe patterns at the firewall or host edge.
3. Keep plugins updated so “known path” exploits fail even when probed.
4. Watch whether 404 storms hide a quieter successful intrusion elsewhere.

## In WP Security Ninja

[404 Guard](https://wpsecurityninja.com/404-guard/) helps cut scanners that hammer missing URLs. [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) can block known-bad IPs and exploit-shaped requests before they chew through workers. Deeper context: [why 404s spike hosting bills](https://wpsecurityninja.com/404-hammering/).