404 scanning

Why it matters for WordPress

Bots do not only hit the homepage. They request thousands of paths that never existed: old plugin folders, .env backups, wp-config.php.bak, known exploit URLs. Each miss is a 404 that still costs PHP or server work. On cheap hosting, that noise shows up as slow sites and higher bills.

How it shows up in practice

• Access logs full of 404s for random PHP filenames
• Spikes right after a popular CVE hits the news
• Hosting panels warning about bot traffic or resource limits
• Scanners looking for leftover zip backups in the web root

What to do

1. Do not leave backup zips, .sql dumps, or wp-config copies in public directories.
2. Block or challenge the noisiest probe patterns at the firewall or host edge.
3. Keep plugins updated so “known path” exploits fail even when probed.
4. Watch whether 404 storms hide a quieter successful intrusion elsewhere.

In WP Security Ninja

404 Guard helps cut scanners that hammer missing URLs. Cloud Firewall can block known-bad IPs and exploit-shaped requests before they chew through workers. Deeper context: why 404s spike hosting bills.