Nonexistant /408.shtml and /403.shtml URLs being requested on WordPress site

Question

The top two most commonly requested nonexistent pages on my WordPress website are the following:

• /408.shtml (3500 times)
• /403.shtml (470 times)

I use the Redirection plugin to track 404 requests, and these are the most common ones, with the next most common being requested only 50 times.

Why would these pages be requested? I speculate that these are HTTP error codes based only on the URLs, but I have never seen either a 403 or 408 HTTP error returned by my website. If those HTTP errors were being returned, would these pages be requested, or would the site just return a blank page and the error code?

Interestingly, the vast majority of the /408.shtml requests are from the same user agent, "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" with no referrer, whereas the /403.shtml requests have a wide variety of user agents, but all include /403.shtml itself as the referrer. Based on IP geolocation, the vast majority, if not all of these requests are from bots not humans.

Answer 1

There was a bug reported against LiteSpeed HTTPD webserver in 2009. Requesting /408.shtml caused the server to crash. That indicates that there is a bug in that server, and possibly a buffer overflow vulnerability that is remotely exploitable.

Those requests against your site are likely to be vulnerability scans looking for installations of LiteSpeed that can be infected. There must be some malware going around that does that scanning that is making far more requests than needed.

As long as you aren't running a vulnerable server, then you have nothing to fear from these requests. It sounds like they just return a "404 Not Found" status which is what you would expect. I wouldn't take any special action because of these. I would just follow the standard advice of ensuring that your server running up to date software.

You might be able to create a list of URLs to ignore in your redirection plugin. I configure my 404 reporting to ignore any requests that don't send a referrer header with a valid looking URL. I separate out referrers from my own site and from third party sites into separate reports. Even then, I usually have to set up a list of URLs like this that I can ignore.