How do I react when somebody tries to guess admin directiories on my website?
admin, apache
Solution
If everything is locked down well, fear nothing. These are just automated attacks that happen to every URL in existence. Same thing happens to me, and I don't even run PHP on my server.
If you don't have the latest patches (like on say, WordPress), then yes this is a big problem, but one that's relatively easy to fix.
Problem
I've been getting these messages in apache error.log for quite a while: ``` [client 217.197.152.228] File does not exist: /var/www/phpmyadmin [client 217.197.152.228] File does not exist: /var/www/pma [client 217.197.152.228] File does not exist: /var/www/admin [client 217.197.152.228] File does not exist: /var/www/dbadmin [client 217.197.152.228] File does not exist: /var/www/myadmin [client 217.197.152.228] File does not exist: /var/www/PHPMYADMIN [client 217.197.152.228] File does not exist: /var/www/phpMyAdmin ``` And many more different addresses. Looks like somebody is trying to guess where my admin applications are located. What should I fear in this situation, and what a knowledge of my admin addresses can give to attacker, if everything is password protected?