Description
URLs with a double-slash prefix (e.g. //lala.php, //wp-admin/images/wp-conflg.php) return HTTP 500 instead of 404. These are all bot/attack probes but they inflate the 5xx error count in logs and monitoring.
Evidence
From production logs on melvin.me (last 7 days):
- ~2,130 total 5xx responses
- 100% are double-slash attack probe URLs — zero real 5xx errors
- Typical URLs:
//about.php, //cgi-bin/index.php, //wp-includes/js/dist/, //class.php
Expected behavior
These should return 404 (not found), not 500 (server error).
Likely cause
The double-slash prefix (//) is probably causing a path resolution error in the resource handler or filesystem layer, resulting in an uncaught exception rather than a clean "not found" response.
Impact
- Low severity — only affects attack probes, no real user impact
- Noisy 5xx metrics in monitoring/analytics
- Simple fix: normalize or reject double-slash paths early in the request pipeline
Description
URLs with a double-slash prefix (e.g.
//lala.php,//wp-admin/images/wp-conflg.php) return HTTP 500 instead of 404. These are all bot/attack probes but they inflate the 5xx error count in logs and monitoring.Evidence
From production logs on melvin.me (last 7 days):
//about.php,//cgi-bin/index.php,//wp-includes/js/dist/,//class.phpExpected behavior
These should return 404 (not found), not 500 (server error).
Likely cause
The double-slash prefix (
//) is probably causing a path resolution error in the resource handler or filesystem layer, resulting in an uncaught exception rather than a clean "not found" response.Impact