# Who attacked my site?

> I set a trap on my site. For a week, I watched who tried the door.

URL: https://iamcanturk.dev/en/shorts/siteme-kim-saldirdi/
Pixel Shorts #18 · November 1, 2026 · for everyone

---

**In short:** Even on a static site, bots try .env, .git and WordPress paths, running the same list against every site. Request .env and .git on your own site: the answer should be 404.

My site is static. No WordPress, no .env, no admin panel.


## What's in the video?
I set a trap on my site. For a week, I watched who tried the door. My site is static. No WordPress, no .env, no admin panel. But the bots came anyway. The most tried path was {{EN_COK_DENENEN_YOL}}. These files don't exist on my site. So the bot runs the same list without checking whose site it is. The requests came from {{ULKE_SAYISI}} different countries. But the country may show where the server is, not the attacker. The trap paths give the bot an empty response and log the request. I don't block anyone. If one of these files is open on your site, these bots will be the first to find it. Try it yourself: request the .env and .git paths on your own site. The answer should be 404. Save this list and check it before you ship. Tomorrow is November 10. We remember Atatürk with respect.

## Check your own project
- [ ] No .env in the web root
- [ ] Don't ship the .git folder
- [ ] Turn off panels you don't use
- [ ] Check your server logs once a week