Web server

Buy Self-Hosted Protection
Live
Demo

Requests, response codes and the most frequent addresses — from the web server access log.

24 hours 7 days
Requests
16,800
RPS
0.03
Error rate
7.4%
5xx
67
Served
391.1 MB
Source: /var/log/nginx/access.log. Only the tail of the log is read, so longer periods may not be covered in full. · Covers: 05.10 22:36 → 12.10 22:38
Requests per hour
Response codes
2xx14,045 · 83.6%
3xx1,512 · 9%
4xx1,176 · 7%
5xx67 · 0.4%
Top paths
/ru/ 2,856
/ru/index.php 1,512
/assets/css/app.css 1,344
/favicon.ico 1,176
/login.php 924
/ru/security_monitor.php 756
/ru/system_metrics.php 588
/assets/js/app.js 588
/sw.js 420
/api/status.php 336
Top IPs
203.0.113.20 1,848
198.51.100.11 336
198.51.100.12 302
198.51.100.13 269
198.51.100.14 235
198.51.100.15 202
198.51.100.16 168
Top errors
404 /wp-login.php 2,184
404 /.env 1,596
404 /phpmyadmin/ 1,008
403 /admin/config.php 588
404 /.git/config 420
Clients
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 3,444
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605 1,596
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com 1,008
curl/8.5.0 672
python-requests/2.31.0 504
Known exploit attempts 7
Log requests that match well-known exploits, and whether each of them can work on this server.
CVETarget AttemptsIP LastDoes it affect you
CVE-2017-9841 PHPUnit eval-stdin.php: code execution 84 5 12.10 22:07 Not affected: no such file (response 404)
CVE-2024-4577 PHP-CGI on Windows: code execution 54 3 12.10 21:09 Not affected: PHP-CGI on Windows only
CVE-2021-3129 Laravel Ignition: code execution 36 2 12.10 19:52 Not affected: no such file (response 404)
CVE-2018-13379 FortiGate SSL VPN: file read 24 2 12.10 18:37 Not affected: a network device or another platform
CVE-2023-1389 TP-Link Archer routers: command injection 18 1 12.10 16:46 Not affected: a network device or another platform
CVE-2012-1823 PHP-CGI: code execution via query string 12 1 12.10 13:26 Not affected: fixed in PHP 5.4.2, this server runs PHP 8.3
CVE-2014-6271 Bash (Shellshock): code execution 12 1 12.10 09:32 Not affected: bash was patched in 2014
Web server hardening

What a visitor of each site on this server receives. Checked with a request to the server itself, refreshed every 10 minutes.

Web server version in responsesnginx
PHP version in responseshidden
TRACE methoddisabled
Site HSTSX-Frame-OptionsX-Content-Type-OptionsReferrer-PolicyPermissions-Policy CSP
example.com
shop.example.com Report-Only
app.example.com —
Amber marks headers worth adding, grey marks nice-to-have ones. CSP cannot be switched on with one line: the policy is built for a specific site, otherwise the site stops loading its own scripts, styles and fonts. Report-Only means the policy is in observe mode.
One command adds what is missing: a separate file in conf.d, reloaded only after nginx -t. A server block with its own add_header ignores the shared lines, so add them to that block as well.
sudo tee /etc/nginx/conf.d/zz-arciveo-hardening.conf >/dev/null <<'EOF' && sudo nginx -t && sudo systemctl reload nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
EOF