While Googling for a few rare user agent strings and URL paths, I stumbled upon a few websites that have their webserver logs publicly accessible.

Investigating further, I found that this is not an uncommon problem, as Googling for "inurl:log intext:Mozilla/5.0" will demonstrate.

My question is: what kind of misconfiguration may allow for logs to be publicly accessible? These logs are usually stored in a different directory, and I can't seem to find a reason why logs would be made accessible in this manner.

  • Why do you assume that it is by mistake? For a blackbox hosting service, this provides an easy mechanism for consumers to get access to the logs.
    – symcbean
    Commented Dec 23, 2015 at 9:43
  • This is true, but even then, most of the black box hosting providers I've seen have enforced some kind of authentication before allowing access to log files - even if it's just a HTTP basic auth dialog to access the folder.
    – Matthew
    Commented Dec 23, 2015 at 9:45

2 Answers 2


There are quite a few possibilities:

  • Someone has changed the log storage directory through a .htaccess or similar configuration file, and the new location is unintentionally within the web root (e.g. they put var/log/apache instead of /var/log/apache as the target)
  • The system has been set up like this with the intention of an IP block preventing access to the folder, and the IP block has been forgotten or disabled
  • An alias has been put in place, in a similar way to the /manual default alias in Apache HTTPd (see Google for many examples)
  • There is an automated log analysis program running which exposes the log data in some way, and no protection has been implemented for this

Essentially, people are endlessly creative when it comes to making mistakes, and log file access is no exception to that!


@Matthew already listed great points. I could think of one more, which I think is quite common:

Some applications but the logs inside their main directory or a subdirectory of it (probably because it's easiest; they know that that location exists and that they probably have read and write rights there) which is often supposed to be public.

They then restrict access to the logs and various other files via htaccess.

The problem here is that the server may ignore those htaccess files, either because it's not an Apache webserver, or because it's configured to not parse htaccess files.

You must log in to answer this question.