# SPDX-License-Identifier: AGPL-3.0-only
# A request for a PHP file that is not there — a 404 on a path ending in
# .php (query or not). Real traffic serves its PHP; a 404 on one means the
# client guessed at a script: a shell left by a previous intrusion
# (/wp-content/uploads/x.php), an installer, a panel, a plugin that is
# not installed. WordPress's own endpoints and paths under /wp- are the
# business of wp-scan-paths and the WordPress rules; this one reads
# everything else, and the php-probe rule counts it.
parser: http-php-missing
log: http
prefilter: '.php'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>/[^ "?]*\.(?i:php[0-9]?|phtml|phar))(?:\?(?P<query>[^ "]*))? [^"]*" 404 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
