# SPDX-License-Identifier: AGPL-3.0-only
# A MISSING image, stylesheet, font or media file. It matches the same
# lines as http-404 and exists so a rule can give it a negative weight
# and cancel them out.
#
# 404 only, deliberately. A 403 on an image is not a missing asset, it
# is something refusing to serve one — a hotlink guard, a firewall — and
# cancelling those would be cancelling a refusal.
#
# That is how "count the probes, ignore the broken assets" is expressed
# here: a page referencing four images that were deleted produces four
# 404s and four of these, and nets to nothing, while four requests for
# /wp-config.php.bak net to four. A scanner does not ask for .woff2.
#
# The extension list is the point of the parser; anything not on it
# counts as a real request. Keep it to things a browser fetches without
# being asked.
# json/webmanifest/xml/txt joined the list on 2026-08-22: a site whose
# /manifest.json, sitemap.xml or robots.txt is missing makes every
# visitor "probe" it on every page — a Bouygues reader of ush-centre.org
# was banned on them. Scanners' .txt/.xml probes under plugin paths are
# wp-scan-paths's; the REST ones are the enumeration rules'.
parser: http-static-miss
log: http
prefilter: '" 404 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?:GET|HEAD) (?P<path>[^ "?]*\.(?:png|jpe?g|gif|webp|avif|svg|ico|bmp|css|js|mjs|map|woff2?|ttf|otf|eot|mp4|webm|ogg|mp3|wav|pdf|json|webmanifest|xml|txt))(?:\?[^ "]*)? [^"]*" 404 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
