# SPDX-License-Identifier: AGPL-3.0-only
# A request for wp-config.php or one of the names a careless backup
# leaves beside it (wp-config.php.bak, wp-config.php~, wp-config.txt).
# The file holds the database credentials. Nothing legitimate asks the
# web server for it — PHP includes it, it is never fetched.
parser: wp-config-probe
log: http
prefilter: "wp-config"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*wp-config[^ "?]*)(?:\?[^ "]*)? [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx
