/autodiscover/autodiscover.xml probes are common internet background noise. The goal is to handle them cleanly without adding unnecessary server load.
Recommended handling
- Return a fast explicit status (404 or 403 per policy).
- Avoid expensive rewrite chains.
- Use Fail2Ban/log-based controls if request rate spikes.
Apache example
RedirectMatch 404 (?i)^/autodiscover/autodiscover.xml$Log hygiene
If noise is high, use conditional logging to reduce operational clutter while preserving security-relevant events.
Security perspective
Repeated probes can indicate scanner traffic. Combine explicit response handling with rate controls at edge and origin.
Validation Commands
sudo fail2ban-client status
sudo fail2ban-client status wordpress-hard
sudo ipset list blacklist | head -n 40Further reading: AbuseIPDB + Fail2Ban Integration
Related posts:
