I have a vb.net website and in the website I've also a WordPress blog website. I'm getting unknown URL in my log file which do not exist in the website. I logged in to Google Webmaster Tools and there were no errors reported.

My website is http://example.com (vb.net) and http://example.com/blog (WordPress)

All URLs like below:

  • example.com/dxyylc/md5.php
  • example.com/xmlrpc.php
  • example.com/wp-login.php?action=register
  • example.com/plus/backup.php
  • example.com/plus/top.php
  • example.com/plus/myjs.php
  • example.com/xiaolei.php
  • example.com/plus/xsvip.php

Any idea why this page is getting constant traffic though? I'm getting 300 or more error URLs on daily basis. How can I solve this?

  • Someone may have a better answer, but I suspect someone probing your site for vulnerabilities.
    – Steve
    Jul 5 '17 at 8:47

The first step is to ensure these URLs do absolutely not exist on your domain. Check your FTP now to make sure of this.

Once you are certain that these files don't exist, then you can safely ignore these entries in your logs. Because in that case they are the result of bots that are trying to find vulnerabilities in your website.

The URLs you're seeing (such as /plus/xsvip.php or /dxyylc/md5.php) probably contained security issues in the past that allowed hackers to gain access in some way. If none of these files are found on your server, the bots will just be served a 404 error and be on their way again.

  • Some file are exist but some files are not. like below both files exist but with different url example.com/xmlrpc.php should be example.com/blog/xmlrpc.php example.com/wp-login.php?action=register should be example.com/blog/wp-login.php?action=register Jul 5 '17 at 9:34
  • Then it's logical for the ones that exist to appear in the access logs. For the ones that don't exist, that will be the bots looking for vulnerabilities as I mentioned in my answer. Jul 5 '17 at 9:37
  • I have printed Uesr IP with Error URL in my logs and checked that IP here tools.tracemyip.org/search--ip/list but all IP are not of google bot. Jul 5 '17 at 9:42
  • These 'bots' that I referred to aren't bots from Google, they are other bots. Those 'bots' are basically just scripts that are ran by malicious people that are trying to find ways to hack a website (for instance to deface it, or to steal user credentials). Jul 5 '17 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.