I saw this in the error log in the cPanel and I think someone is accessing my files.

[Sat Oct 01 07:05:38.875312 2016] [:error] [pid 430322] [client] File does not exist: /home/mysitename/public_html/wp-login.php

I am newbie, please help me.

  • 6
    If you are a newbie, I suggest you stop hosting an internet-facing server until you get more experience. Sorry to sound harsh, but it's only a matter of time before your server gets compromised (especially with cPanel on it) and starts spewing spam and DoS everyone else's servers... – André Borie Oct 1 '16 at 3:07
  • what do you mean of internet-facing server? – Da Heel Oct 1 '16 at 4:08
  • @A.Darwin "Web servers are by definition Internet-facing servers." Not by definition. I run a web server on my own PC which is not exposed to the Internet at large (listening only on the loopback interface, plus two layers of firewalling before you get to it). In the OP's case it is probably safe to say that the relevant web server is exposed to the Internet, but you cannot make the same claim in the general case. – a CVn Oct 1 '16 at 11:07
  • 1
    @MichaelKjörling Yes, sorry about that. I knew it, but when I realized I was wrong I could only delete my comment, not edit it. So, for the sake of clarity, "an Internet-facing server is a server you can connect to not only from your LAN, but from the whole Internet. Since everybody can connect to it, there are more chances that an attacker will eventually access its files. If your server is running a website that can be accessed on the Internet, it is an Internet-facing server". – A. Darwin Oct 1 '16 at 11:13
  • @A.Darwin Much better, IMO. – a CVn Oct 1 '16 at 11:14

You're probably fine, this was likely an automated scan searching for WordPress installations across the Internet. If that's the only log entry, I'd ignore it.

| improve this answer | |

There are many botnets all over the internet that are scanning WordPress sites and looking for vulnerabilities or poor security practices such as exposing WP login publicly.

So in your case this is not an attack yet. However it might be if you will notice on your logs that someone for example is brute forcing your WP login page.

| improve this answer | |
  • I do not have a WP login page. – Da Heel Oct 2 '16 at 1:50

In one way, it is an attack, someone is trying to gain access to your wordpress installation by doing a password guess

| improve this answer | |
  • There's no indication that the user is running WP. This log entry shows the equivalent of a 404. So if the OP is using WP, he's migrated the login page to another location. – HashHazard Oct 1 '16 at 14:46
  • he asked "if i am being attacked" i answered specifically yes, because someone indeed is trying to gain access to "whatever" he has.. doesnt matter if he has WP or not.. – Hamza Islam Oct 1 '16 at 20:45
  • 1
    How can I protect myself from this? – Da Heel Oct 2 '16 at 1:50
  • you have to install some tools like mod-security(web application firewall), and some firewall. also host website behind cloudflare – Hamza Islam Oct 2 '16 at 5:07
  • How do you know they were doing a password guess based on that information? He's already stated in another post that he's not using WP, so what did the actor perform such a guess on? – HashHazard Oct 2 '16 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.