Protecting a Website from Bot Scanning
You open access.log — and there it is, the knocking. Regular. Brainless. Mechanical, like
a woodpecker running on numerical control.
/wp-login.php. /.env. /.git/config. /phpmyadmin/.
The site, incidentally, is built on Hugo. WordPress has never lived here. Not for one single day.
And yet they keep knocking. Forty seconds pass — and there it is again. Day and night. No lunch breaks, no weekends, no conscience.
And no. This is no break-in.
This is an inventory. A stroll through with a notepad: so, what have you got here worth taking?







