1

The top two most commonly requested nonexistent pages on my WordPress website are the following:

  • /408.shtml (3500 times)
  • /403.shtml (470 times)

I use the Redirection plugin to track 404 requests, and these are the most common ones, with the next most common being requested only 50 times.

Why would these pages be requested? I speculate that these are HTTP error codes based only on the URLs, but I have never seen either a 403 or 408 HTTP error returned by my website. If those HTTP errors were being returned, would these pages be requested, or would the site just return a blank page and the error code?

Interestingly, the vast majority of the /408.shtml requests are from the same user agent, "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" with no referrer, whereas the /403.shtml requests have a wide variety of user agents, but all include /403.shtml itself as the referrer. Based on IP geolocation, the vast majority, if not all of these requests are from bots not humans.

  • What makes you think that those URLs are related to 403 and 408 status codes? Those URLs could return any status code. – Stephen Ostermiller Apr 3 at 14:24
2

There was a bug reported against LiteSpeed HTTPD webserver in 2009. Requesting /408.shtml caused the server to crash. That indicates that there is a bug in that server, and possibly a buffer overflow vulnerability that is remotely exploitable.

Those requests against your site are likely to be vulnerability scans looking for installations of LiteSpeed that can be infected. There must be some malware going around that does that scanning that is making far more requests than needed.

As long as you aren't running a vulnerable server, then you have nothing to fear from these requests. It sounds like they just return a "404 Not Found" status which is what you would expect. I wouldn't take any special action because of these. I would just follow the standard advice of ensuring that your server running up to date software.

You might be able to create a list of URLs to ignore in your redirection plugin. I configure my 404 reporting to ignore any requests that don't send a referrer header with a valid looking URL. I separate out referrers from my own site and from third party sites into separate reports. Even then, I usually have to set up a list of URLs like this that I can ignore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.