Guides

How to Read Nginx Access Logs for Attack Signs

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 27 October 2026 · Last updated: 27 October 2026

On your web server, read /var/log/nginx/access.log. Look for odd paths (/wp-login.php on a non-WordPress site), long query strings, and repeated 404 spikes from one IP. Start with sudo tail -n 200 and a few grep filters.

sudo tail -n 50 /var/log/nginx/access.log
sudo grep -E 'wp-login|xmlrpc|\.env|phpunit|/admin' /var/log/nginx/access.log | tail

Why read access logs?

Your access log is a diary of every request. Attackers leave footprints: scans for .env, WordPress logins, PHPUnit RCE paths. Nora in Oslo and Manish in Hubli review theirs after any odd spike in traffic.

What does a line look like?

Combined format usually has IP, time, method, path, status, bytes, user-agent.

203.0.113.9 - - [27/Oct/2026:10:11:12 +0530] "GET /.env HTTP/1.1" 404 125 "-" "curl/8.0"

What it means: This bot asked for .env and got 404 — probe failed. Good.

How do I hunt step by step?

1. View recent lines:

   sudo tail -n 50 /var/log/nginx/access.log

   What it means: See the newest traffic first.

2. Common probes:

   sudo grep -E 'wp-login|xmlrpc|\.env|\.git|phpunit' /var/log/nginx/access.log | tail -n 20

   198.51.100.20 ... "GET /wp-login.php HTTP/1.1" 404
   198.51.100.20 ... "GET /.git/config HTTP/1.1" 404

   What it means: Same IP tried CMS and git metadata paths. Noise if all 404.

3. Top talkers:

   sudo awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head

   What it means: Ranks source IPs by request count.

4. Unexpected successes on odd paths:

   sudo awk '$9==200 && $7 ~ /env|git|phpunit|wp-login/ {print}' /var/log/nginx/access.log | tail

   What it means: 200 on those paths deserves urgent review.

5. If something looks real, follow Is my website hacked? and rotate secrets.