Protecting a Website from Bot Scanning

You open access.log — and there it is, the knocking. Regular. Brainless. Mechanical, like a woodpecker running on numerical control.

/wp-login.php. /.env. /.git/config. /phpmyadmin/.

The site, incidentally, is built on Hugo. WordPress has never lived here. Not for one single day.

And yet they keep knocking. Forty seconds pass — and there it is again. Day and night. No lunch breaks, no weekends, no conscience.

And no. This is no break-in.

This is an inventory. A stroll through with a notepad: so, what have you got here worth taking?