Back to Blog

Why Static Sites Laugh at Bot Attacks

October 27, 2025 (2mo ago)

SecurityNext.jsNginxDevOpsPerformanceStatic Site

💥 My server logs are currently being hammered by thousands of vulnerability scans a day, but the CPU load hasn't budged.

I see endless requests probing for common exploits:

  • /wp-admin/wp.php
  • /111.php
  • /code.php
  • /.git/config
  • /i.php
  • /admin
  • /api/.env
  • /kal.php

These bots are desperately hunting for WordPress login panels, exposed environment variables, and ancient PHP backdoors.

The best part? none of it matters.

My entire site is pre-rendered static HTML, generated by Next.js and served directly via Nginx.

There is no PHP engine to overload. There is no database to crash on every request. There is just lightning-fast static content and aggressive caching.

Watching malicious scripts hit a brick wall of instant 404s is incredibly satisfying. When it comes to resilience, static wins every time.