Getting and reading your log
Every web server can keep an access log: one line per request, written as it happens. Here is where to find yours and how to read what the report says.
Where to find the log
- cPanel hosting: in cPanel, open Metrics, then Raw Access, and click your domain to download its current log. It arrives as a
.gzfile: give it to the reader as it is, no need to unzip. - Apache on Debian or Ubuntu:
/var/log/apache2/access.log(older days inaccess.log.1,access.log.2.gz...). - Apache on Red Hat, Rocky, AlmaLinux or Fedora:
/var/log/httpd/access_log. - Nginx:
/var/log/nginx/access.log. - Other hosting: look for "raw access logs", "access logs" or "server logs" in the control panel, or ask the host. Some hosts keep them only for a few days, so download regularly if you want to compare months.
What a line looks like
The usual "combined" format, used by default on most servers:
203.0.113.7 - - [03/Oct/2026:14:05:09 -0400] "GET /menu HTTP/1.1" 200 18234 "https://www.google.com/" "Mozilla/5.0 (...)"
Address, date and time, the request, the status code, the size sent, the page or site that linked here (referrer), and the browser or bot (user-agent). The "common" format stops after the size, so it cannot tell bots from people or say who sent them.
Status codes in one minute
- 200 OK. 304 not modified: the browser already had it.
- 301 / 302 redirected elsewhere.
- 403 forbidden. 404 not found: a missing page, an old link, or a probe.
- 500 / 502 / 503 the server failed: the visitor saw an error. Fix these first.
Why it differs from your analytics
- Analytics scripts count only browsers that run the script (and, where consent banners apply, accept it). The log counts every request the server answered, bots included.
- Pages served from a cache or CDN in front of your server may never reach the log.
- A log sees addresses, not people. The visitor number is an estimate: one router can hide a household, one phone can change address.
Bots, and fake bots
Bots are named by the user-agent they send, and anyone can send any user-agent. Google and Microsoft publish how to check that a visit really came from their crawlers (a reverse DNS lookup of the address, then a forward lookup): see Google's guide and Bing's guide. A robots.txt file asks well-behaved crawlers to stay out of what you list; it does not stop the others.
Attack probes
Every public site is scanned all day for well-known weak spots: /wp-login.php, /xmlrpc.php, /.env, /.git/config, phpMyAdmin and others. A 404 answer to these is what you want. A 200 answer for a file like /.env means it is public: take it down and change any password it held.