Caddy

Report scanners found in Caddy's JSON access logs.

Caddy writes structured JSON access logs, which makes scanners easy to pick out with jq.

Turn on access logging

example.com {
    log {
        output file /var/log/caddy/access.log
        format json
    }
    ...
}

Report scanners

jq -r 'select(.request.uri | test("^/+(\\.env|\\.git/|wp-login\\.php|xmlrpc\\.php|phpmyadmin|vendor/phpunit)")) | (.request.client_ip // .request.remote_ip)' /var/log/caddy/access.log | sort -u | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=web-app-attack,vuln-scan -d comment="caddy: probing for .env/.git/wp-login"

client_ip respects Caddy's trusted_proxies setting, so it is the real visitor even behind Cloudflare. Older Caddy versions only have remote_ip.

Run it hourly from cron, and remove any path your site really serves.

Need a hand?

If something here does not work with your version of Caddy, or you have improved it, tell us. We update these pages with what people send.

Caddy and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.