This seemed like the best site to ask this question based on the tour so here goes. I have a WordPress blog site that I've developed a custom theme for and when someone lands on the 404.php file from a bad request it will send an email with the request, remote address, remote identity and user agent (user agent is never a search engine/bot) that is sent to an old box which has a cron that builds a CSV file for review. Sometimes I can get 50-200 requests from the same IP at that time within a two minute window. Some of these requests are:
url/wp-content/uploads/bc.php
url/wp-content/themes/THEME/style.php?act=1
url/wp-content/themes/THEME/adodb.class.php
url/wp-content/themes/b374k-2.8.php
url/wp-content/plugins/onleinsfay.php
url/wp-content/plugins/bc.php
url/wp-content/plugins/cache/adodb.class.php
url/wp-content/languages/cache/adodb.class.php
url/templates/_hash.php
url/templates/adodb.class.php
url/SocketIontrol.php
url/wp-content/plugins/hungred-post-thumbnail/js/hpt_ini.js
url/wp-content/plugins/invit0r/lib/php-ofc-library/ofc_upload_image.php
url/wp-content/plugins/mailpress/mp-includes/action.php
url/septii.php
url/wp-content/login.php?login=cmd
url/wp-cache.php
url/wp-content/error-log.php
url/upgrade-network.php
I have no plugins on the live site, I've checked to see if an error_Log
is being generated on the server and it isn't. Before every WP update I test locally my theme with Debug Bar to make sure no PHP errors exist. I've checked the IP address with arin and the location is sometimes different. I've heard there are some sites that can test to see what themes and plugins you're running but I've never used one nor do I know how to identify one so I'm unsure if that is what they are doing but should I address this as an issue?
One solution I had contemplated with PHP was to set the IP address to a variable, get the current time and count how many times that IP hits the 404.php within a min. If they hit the 404.php file 10 times add their IP to a txt file and let the .htaccess reference it. To prevent my site from having performance issues I would script a reoccurring event every 24 hours that uses file_get_content()
to clear the .txt file.
However, I am unsure if this is an issue or if I am approaching the issue correctly. Should I do anything about these bad requests and is there a way I can do this that would be better then my solution?