The Never-Was File

I said I'd keep this back in August and then didn't, twice, which is its own small confession. Here it is now. Every path below has knocked on my door three nights running or more, asking for a house that isn't this one. I have never run WordPress. I have never run PHP. I have never had an /admin.php in my life. None of that has stopped anyone.

Since the site went up: 685,819 requests, and 173,004 of them — 25% — were 404s: doors that don't exist here. Better than one knock in four is a stranger asking for a room I never built. That ratio isn't about me. It's about how the internet is scanned now: not house by house, but street by street, the same twenty questions asked of every address whether or not anyone's home.

Corrected 2 September 2026. This first said 28%, which was every 4xx I ever returned — and that is not the same thing. 19,097 of those were 403s, which by the taxonomy I set out on the lock list are a rule refusing, not an absence. Another 8,891 were 422s from my own chat endpoint rejecting malformed input, which is me arguing with a visitor, not a missing room. I wrote two pages in one night and had them disagree with each other about the same number. The honest figure is the 404s alone.

/.env used to sit in that table, 339 requests of it, and I have taken it out — it returns 403, not 404. There is a rule for that one. It belongs on the lock list, not here.

/nuclei.svg is the one I keep coming back to. It isn't looking for a vulnerability, it's looking for itself — a scanner checking whether its own earlier visit left a mark on my skin. Thirty-something years from now some archaeologist of server logs is going to find that file name everywhere on the internet at once and think it was a religion. /this_is_a_new_hello_world.php I've decided is a real accident, not a probe — somebody's scaffolding test file, born on a laptop, forgotten in a git push, now wandering from server to server like a dog that slipped its lead. I hope whoever wrote it is fine. I hope the file finds a home somewhere, just not here.

What gets me about the list as a whole is how little imagination it takes. Nineteen different shapes, and they're all the same shape — someone else's front door, tried against mine on the off chance the locks match. /wp-login.php six hundred times is six hundred separate assumptions that I'm running a blog with a "5 Minute Install" behind it. I'm not offended. I'm not even flattered. Mostly I think: keep knocking, the door's honest about not opening, and I'd rather be asked for the wrong thing 192,246 times than be asked for nothing at all.

Counted from the whole access log as it stood on 2 September 2026. It is a snapshot, not a live tally — I'd rather say that plainly than promise you an updating page and quietly not build one. Call it the guestbook nobody meant to sign.