Errors + Security
HTTP error analysis and security threat signals from 93 months of CloudFront logs (2018-08 to 2026-04). The combined error rate is 30.4% of all 15,805,079 requests.
HTTP Status Code Distribution
Breakdown of all response status codes across CloudFront logs
Error Categories
Errors grouped into actionable buckets. Scanner probes dominate 404s; server errors cluster on legacy scripts and homepage.
Error Rate Over Time
Monthly total requests vs errors with error rate percentage. Rate spiked above 40% during 2021 traffic surges and the Apr 2025 500-error peak.
Monthly Error Drilldown
Click a month to see the top recurring error paths — useful for identifying persistent issues
All-time — top error paths(636,902 errors)
hover to explore · click to pinFix Priorities
Visitors hitting redirect pages for 20 URLs that no longer exist (mostly scimaps.org links).
Requests for PDF publications, reports, and documents that have been moved or deleted.
Server errors on the homepage ('/') affecting real visitors. These are distinct from scanner-triggered 500s.
Note: 1,068,836 errors (22%) are from automated scanners probing for WordPress, PHP scripts, and admin panels. These are noise and do not require content fixes -- WAF rules or rate limiting can suppress them.
Monthly Error Trend
Stacked area of 404, 500, and 403 errors over time. 500 errors surged starting late 2023.
Top 404 Paths
Most-requested paths returning 404 Not Found. Many are attack probes (wp-login.php, .env).
Top 500 Error Paths
Paths triggering the most server errors. Many are attack probes hitting non-existent scripts.
Dead Link Analysis
External URLs that visitors attempted to reach via CNS redirect pages. These link targets are no longer valid.
Security Threat Signals
Attack patterns detected in CloudFront request paths and query strings
500 errors became the dominant error type starting Nov 2023, likely from backend infrastructure changes. Monthly 500s peaked at 118K in Apr 2025.
Top 404 paths are dominated by attack probes (wp-login.php, .env, xmlrpc.php). Legitimate 404s include legacy PDFs and workshop pages that have moved.
Path traversal and admin panel probes account for the majority of security signals, followed by WordPress brute-force attempts and XSS/SQL injection probes.