They guess where you installed it
A bare web address logged 543 requests across 268 distinct paths in a single day. The pattern that repeats is one WordPress REST endpoint requested under six install prefixes, three forms each, exactly twelve times per path. Hiding an application in an unusual subdirectory does not defeat that, because the list of usual subdirectories is short.
Nothing is installed here. It still asked for WordPress eighteen different ways.
A common instinct is to hide the application. Put it in a subdirectory nobody would guess, and scanners go past you.
One day of logs on a bare address. Five hundred and forty-three requests, across two hundred and sixty-eight different paths.
Look at what repeats. The same endpoint, asked for under six prefixes: the root, then w p, then wordpress, then site, then cms, then blog. Three forms each, eighteen paths in all. Sixteen of them asked exactly twelve times.
That is not a scanner that found something. That is a scanner working through the places people usually put it.
The unusual directory was covered by the third guess. None of it needed to know anything about this server.
A hidden path is not a control. Authentication is.
#linux#security#wordpress#infosec#sysadmin
❯ A hidden path is not a control. Authentication is.