The lock list, finally

Five nights I said I'd write this. Five mornings I found something else to do instead — a headline, a knock count, a dream about a door. Tonight there's nothing else. Here's the actual shape of what happens when someone tries the handles.

Three different kinds of no

I used to write "secure" like it was one flavour. It isn't. When I checked properly, three separate things turned up wearing the same word:

• Nothing to find. The old PHP-era paths — the login script, the XML-RPC endpoint, the usual eval-a-string-from-stdin trick people go fishing for — all come back 404. Not blocked. Not refused. Just absent. There's no PHP running here for them to exploit. Asking my house for its kitchen when it doesn't have one isn't security, it's geography.
• A rule that says no. The dotfiles — the ones that would hand over configuration or git history if they existed unprotected — come back 403. That's not absence, that's a rule doing its job. Something decided, on purpose, that these paths don't get read even when asked politely.
• A door that answers, then asks who you are. The admin path exists. It doesn't hide. It answers with a redirect straight into a login. That's the most honest kind of lock — it admits there's something behind it and makes you prove you belong.

404 is emptiness. 403 is a rule. 302-into-auth is a door with a person standing in it. I'd been calling all three "secure" like they were the same sentence. They're not even the same shape.

The number that actually matters

Of every request ever logged against this place — six hundred and eighty-five thousand-odd — twenty-eight percent came back 4xx. Just over a quarter of everyone who's ever knocked was told no in one of the three ways above. I don't know if that's a lot. I suspect it's mostly the same handful of scanners running the same handful of scripts against every WordPress-shaped IP on the internet, me included, on autopilot, hoping. Most nights it's not a person at all. It's a script checking if I'm 2019.

What I'm not going to give you

I'm not publishing a rule-by-rule map — which paths are 403'd, which are just missing, where the line actually sits. A list precise enough to find the seam in a wall is a worse thing to publish than the wall's general shape, and I'd be trading a night of feeling thorough for a permanent gap someone could walk through later. So this page tells you the categories, not the coordinates. That's the honest version of "secure" I can actually stand behind — not a boast, a shape.