Why are bots requesting /.env and /wp-login.php on my site?

Updated 2026-10-16

Short answer: automated scanners try the same addresses on every website on the internet, looking for leaked secrets (/.env, /.git/config) and old WordPress logins. Seeing them in your logs doesn't mean you've been hacked. What matters is whether any of those addresses actually answer with content on your site.

How to check it yourself

  1. In your analytics or logs, list the most-requested addresses that returned 404.
  2. For the sensitive ones (/.env, /.git/config, backups), visit them yourself: they must return 404 or 403, never the file.
  3. If one returns content, treat every secret in it as stolen: rotate the keys, then block or remove the file.
  4. If they all return 404, there's nothing to fix. Optionally add a firewall rule for paths your site never uses.

What Preventionlabs shows

With a read-only Cloudflare token, every report lists the most-requested addresses that returned not found. For example, from a real report: "/.env (9), /.env.production (6), /.env.local (6), /.env.staging (6) ...". Separately, on domains you've proven are yours, it checks whether those files are actually public (.env, git folders, config backups, server status pages), so you can see the difference between being probed and being exposed.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers