Access logs often show hits on `/wp/`, `/wordpress/`, `/wp-json/`, and `/?rest_route=` even when the site is not WordPress. Operators did not open those screens; scanners probe the same patterns worldwide.
In July 2026, the “wp2shell” WordPress issues drew attention, and IPA published an alert. Reports of REST API probes rose around that time. This article explains common probe paths and what to check first on WordPress and non-WordPress sites. It does not describe how to reproduce an attack.
Why WordPress-only URLs appear
Many public sites run WordPress, so scanners try WordPress-like entry points first. A Laravel or static site is still probed the same way. Typical paths include install guesses such as `/wp/` and `/wordpress/`, admin paths, and REST API paths such as `/wp-json/` or `/?rest_route=`.
Seeing those lines does not mean the site is already compromised. Often it is only a check for an open door. Leaving a misleading 200 response can encourage more attempts.
How to read status codes
- 404 — path missing; natural for non-WordPress sites
- 403 — often blocked by a WAF or server rule
- 301 / 302 — redirect to another URL
- 200 / 207 — something was returned; confirm content on WordPress, and avoid serving the homepage for fake WordPress paths on other stacks
A 200 is not proof of compromise, and a 404 is not proof of safety. Logs tell you what to inspect next.
If you run WordPress
IPA’s July 2026 alert covers combinations that can lead to remote code execution on affected WordPress releases. Fixed builds include WordPress 6.9.5 and 7.0.2. Confirm the live version, not only that auto-update is enabled.
Logs are often searched for `/wp-json/batch/v1` and `rest_route=/batch/v1`. A match alone does not prove a breach. Check whether the same source then tried plugin uploads or unknown PHP files. Short log retention can hide older attempts. A WAF block is a bridge until the update lands, not a substitute.
If you do not run WordPress
Return 404 for missing WordPress paths. Do not answer probe query parameters with the same 200 homepage. Canonicalize www and trailing slashes with 301 so probes and search engines see one host.
Summary
WordPress-shaped probes are common noise on public sites. On WordPress, update first and review related log lines. On other stacks, refuse fake WordPress doors with 404. Primary sources: IPA’s WordPress alert and official WordPress security releases.
Makoto Tejima can help read access logs, public URL responses, and entry-point inventories for WordPress or custom sites. Please contact us.