Archive / Post
"Googlebot" knocked on my websites hundreds of times last week.
Most of those knocks weren't Google.
Over the past 7 days, the Cloudflare logs across my sites showed hundreds of requests claiming to be Googlebot or Bingbot. They weren't indexing pages. They went straight for /.env and /.git, the files where passwords and API keys tend to sit.
On one site, all 114 requests that claimed to be Googlebot or Bingbot and went for /.env or /.git were fake. Every one.
Anyone can type "Googlebot" into a request. It's a name tag, not an ID.
Five things worth doing this week if you have a website:
Lock the junk drawer.
Block public access to .env, .git and backup files (.zip, .bak, .sql), or keep them off the web server entirely. If a key in one of those files was ever exposed, rotate it. Deleting the file doesn't un-leak it.
Patch on a schedule.
Keep PHP, WordPress, themes and plugins current. These bots are shopping for old versions with known holes.
Turn off directory listing, so a folder without a home page doesn't show the world every file inside it.
Check the badge, not the name tag.
Real Googlebot traffic passes a reverse DNS lookup to googlebot.com or google.com, and a forward lookup that lands back on the same IP. Real Bingbot does the same check against search.msn.com.
Put a bouncer at the door.
A web application firewall or bot rules, like the ones Cloudflare offers, can stop fake crawlers before they ever reach your site.
None of this is fancy. It's an afternoon of work that closes the doors these bots are testing every day.
Questions about your own site? Happy to point you in the right direction.