How to Detect and Block PHP Bot Attacks on Your Website

Recently, while monitoring server logs for XavierMedia.com, we noticed a series of suspicious entries in the Apache error log. These log entries revealed attempts to access PHP files that do not exist, such as:

/report.php  
/register_global.php  
/sort-ratings.php  

These attempts originated from a variety of IP addresses within a short timeframe, clearly indicating an automated scan — a bot or script trying to probe your site for known vulnerabilities in outdated or misconfigured PHP scripts.

What Do These Attacks Mean?

These bots are not targeting you specifically. Instead, they scan many domains, hoping to find poorly secured installations. If they discover a vulnerable script (e.g., a forgotten register_global.php file or a misconfigured upload handler), they can:

• Gain remote control of your server
• Upload malware or phishing pages
• Hijack your website to mine crypto or send spam

Even if you’re not running any of these old scripts, these scans still consume server resources and clutter your logs.

How to Stop These Bot Attacks

Here’s a step-by-step guide to detect and block these unwanted probes.

✅ 1. Review Your Error Logs

Look for entries like:

script not found or unable to stat: /home/youraccount/public_html/sort-title_desc.php

This means the file does not exist — good! But it also confirms a scan attempt.

✅ 2. Block the Offending IPs in .htaccess

Add rules like this to your .htaccess:

<Limit GET POST>
  order allow,deny
  allow from all
  deny from 145.239.89.234
  deny from 217.113.194.236
  deny from 5.102.173.71
</Limit>

These IPs are often cloud-hosted proxies or infected machines used for automation.

✅ 3. Monitor for New Attacks

Check your logs regularly, and use our new tool to scan your logs for bots.

At tools.xaviermedia.com, we have a set of free utilities to help protect your website from bot scans:

• PHP Bot Scanner Analyzer
  Upload your error log and get a list of suspicious IPs and scripts automatically extracted for blocking.
• Auto-Generate .htaccess Rules
  Enter a list of IPs and receive ready-to-copy .htaccess code to block them.
• Bot Trap Generator
  A simple script to deploy “honeypot” fake pages that log and ban bad bots automatically.

Like these tools or got other ideas? Let us know here »