In short
A scanner is a program that works through addresses automatically, looking for exploitable weaknesses. It does not read your content and has no interest in your business. It tries paths where something useful tends to sit.
Unlike a crawler it does not name itself. It disguises itself as a browser or carries no recognisable user agent at all.
What we measure
Across eleven hosts we run or look after, 11 August to 10 September 2026, 751,386 requests in total.
Scanners are the single largest class with 263,067 requests, 35 percent of all traffic. More than humans, and more than AI crawlers and search bots combined.
More interesting than the average is the spread. The smaller and quieter a site, the more they dominate:
| Type of site | Scanners | Humans | Ratio |
|---|---|---|---|
| Local IT service | 46,593 | 1,851 | 25 to 1 |
| Personal site of a freelancer | 29,359 | 1,464 | 20 to 1 |
| Online CV | 17,460 | 1,568 | 11 to 1 |
| Our own company site | 80,929 | 24,526 | 3 to 1 |
On a personal site with a few dozen visitors a day, twenty automated requests arrive for every human one. That is not an attack, it is the background level of the internet.
What they ask for
Measured against the WAF logs of scmc.ch, 30 days to 11 September 2026. The site is a serverless application and runs no WordPress anywhere.
| What is being sought | Requests |
|---|---|
WordPress paths, mostly /wp-admin/install.php and /wp-admin/index.php |
around 1,900 |
Environment files in five spellings, .env, .env.local, .env.backup, .env.old, .env.production |
426 |
Git metadata, /.git/config and /.git/HEAD |
237 |
The WordPress part is the instructive one. /wp-admin/install.php alone was requested 776 times, on a site that has no WordPress and never had. Scanners do not check first whether the attempt is worth it. Trying is cheaper than looking.
The environment files are the expensive part. A site that serves a .env usually serves credentials with it.
The most common mistake
“Nobody knows us, nobody is looking for us.”
Nobody is looking for you. You get found anyway, precisely because nobody is looking specifically. Address ranges are worked through wholesale, and a small site is not a smaller target, just one address among many. In our numbers the smallest sites are hit hardest, because the human traffic that would shift the ratio is missing.
Where the boundaries run
AI crawler fetches content so a model can answer from it, and names itself while doing so, see AI crawler.
Forgery. A scanner carrying the user agent of an AI crawler to get let through. At scmc.ch, 95 percent of requests with a crawler user agent were forgeries like that, see Verified crawl.
Attack. A scanner hit is not yet an incident. It becomes one when something answers that should not.
How to check it yourself
Search your access logs for /wp-admin, /.env and /.git/config. If the counts run into the hundreds and your site does not even know those paths, you are looking at the background level. After that the question is no longer whether anyone knocks, but what happens when a door opens.
Sources
- Own measurement across eleven hosts, Munot daily cubes, 11 August to 10 September 2026
- Own measurement, WAF logs of scmc.ch, 30 days to 11 September 2026, CloudWatch Logs Insights