{
  "source_file": "0930",
  "source_platform": "Dev.to",
  "author": "Edward Izgorodin",
  "title_listed": "My Analytics Panel Says AI Assistants Are Desperate for /wp-config.php",
  "keywords": "",
  "domain": "机器学习",
  "content_type": "深度技术解析",
  "is_paid_flag": "否",
  "url": "https://dev.to/izgorodin/my-analytics-panel-says-ai-assistants-are-desperate-for-wp-configphp-3lae",
  "publish_date": "2026-09-01",
  "corpus_stage": "",
  "notes": "",
  "id": "5a25c1eed2b4",
  "collected_at": "2026-10-02T14:03:22",
  "title": "My Analytics Panel Says AI Assistants Are Desperate for /wp-config.php - DEV Community",
  "body_markdown": "One finding, and it is about an instrument rather than a threat.\nCloudflare's AI Crawl Control has an Optimization tab. It shows two tables. The first is labelled \"Understand what content is used in AI answers.\" The second is labelled, word for word:\nCheck what AI Assistants are trying to access, but can't.\nRead that second label the way it is written. It says these are the things assistants want from you and are not getting. It reads like a content backlog.\nHere is the top of that table on a site I work on:\n/config.toml\n/local.settings.json\n/@fs/app/.env\n/wp-config.php~\n/config.env\nEnter fullscreen mode\nExit fullscreen mode\nFurther down:\nid_ed25519\n,\ngcp-key.json\n,\nservice_account.json\n,\nterraform.tfstate\n,\naws-exports.js\n,\nbackend/settings.py\n.\nThose are not unmet demand. That is a credential scanner working through a wordlist.\nWhy they are in there\nThe answer is in Cloudflare's own documentation for the same feature, and it is not hidden:\nOn the free plan, AI Crawl Control identifies AI crawlers based on their user agent strings.\nVerification of who a crawler actually is, through bot-management detection, is a paid-plan feature. On the free plan, \"AI assistant\" means a request that wrote\nUser-Agent: ChatGPT-User\nabout itself.\nA scanner sets that header and is counted as an AI assistant. Every probe it makes becomes a data point about what AI assistants want.\nHow much of the panel this is\nOn the sample I checked, over a single day:\n79 percent of the \"most visited pages\" table, and 94 percent of the \"demand signals\" table, are requests for paths that do not exist and never have.\nThe provider breakdown says the same thing from another angle. One provider accounts for 92.5 percent of the volume, and it is the one whose user-agent string is the cheapest to imitate. The three providers that are harder to impersonate come to a couple of hundred requests between them, which is a far more believable number for genuine assistant traffic.\nThe part that is actually dangerous\nA metrics panel that mislabels traffic is an annoyance. A metrics panel that mislabels traffic\nand then tells you what to do about it\nis something else.\n\"Check what AI Assistants are trying to access, but can't\" is an instruction. Followed literally, on the data it is presenting, it says: create\n/config.toml\n. Create\n/wp-config.php\n. Publish\n/.env\n.\nNothing in the interface marks those rows as probes. There is no flag, no separate bucket, no note. They sit in the same table as your documentation pages, sorted by the same column, styled the same way.\nWhat I would do with it\nDo not act on that table.\nNot one row, not ever.\nFilter with an allowlist, not a blocklist.\nI tried a blocklist first, pattern-matching the obvious probe shapes, and it let\nid_ed25519\nand\nterraform.tfstate\nthrough as legitimate. Listing the paths that actually exist on the site is the only filter that holds, because the probe wordlist is longer than your imagination.\nThen keep what survives.\nUnderneath the noise there is a genuinely useful signal that no other instrument gives you: which of your pages assistants actually fetch, as distinct from which pages rank. Those are different lists, and the difference is worth knowing.\nThe panel is not useless. It is just reporting the wrong thing loudly and the right thing quietly, and the label on top points at the loud half.\nDisclosure: I work on\nMnemoverse\n, a memory engine for AI agents. The percentages above come from one day of one site's own export. The Cloudflare documentation quoted is public and says the same thing to anyone who opens it.",
  "metadata": {
    "title": "My Analytics Panel Says AI Assistants Are Desperate for /wp-config.php - DEV Community",
    "description": "One finding, and it is about an instrument rather than a threat.  Cloudflare's AI Crawl Control has... Tagged with ai, webdev, security, analytics.",
    "keywords": "ai, webdev, security, analytics, software, coding, development, engineering, inclusive, community",
    "author": null,
    "og:type": "article",
    "og:url": "https://dev.to/izgorodin/my-analytics-panel-says-ai-assistants-are-desperate-for-wp-configphp-3lae",
    "og:title": "My Analytics Panel Says AI Assistants Are Desperate for /wp-config.php",
    "og:description": "One finding, and it is about an instrument rather than a threat.  Cloudflare's AI Crawl Control has...",
    "og:site_name": "DEV Community",
    "og:image": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Faprge4ksuqmaeuydslrl.png",
    "twitter:site": "@thepracticaldev",
    "twitter:creator": "@",
    "twitter:title": "My Analytics Panel Says AI Assistants Are Desperate for /wp-config.php",
    "twitter:description": "One finding, and it is about an instrument rather than a threat.  Cloudflare's AI Crawl Control has...",
    "twitter:card": "summary_large_image",
    "twitter:widgets:new-embed-design": "on",
    "twitter:image:src": "https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Faprge4ksuqmaeuydslrl.png"
  },
  "paywall": {
    "listed_paid": false,
    "detected": false,
    "marker": "",
    "public_only": false,
    "policy": "付费/会员内容只保留页面公开可见部分，不绕过付费墙"
  },
  "crawl": {
    "success": true,
    "status_code": 200,
    "error": ""
  },
  "code_blocks": [
    {
      "file": "attachments/5a25c1eed2b4/code/body-000.txt",
      "chars": 76,
      "language": "text"
    }
  ],
  "images": [],
  "audio": [],
  "videos": [],
  "links": [
    {
      "href": "https://mnemoverse.com/",
      "label": "Mnemoverse",
      "type": "a"
    }
  ],
  "repair_version": 2,
  "repaired_at": "2026-10-14T10:49:31Z",
  "source_url": "https://dev.to/izgorodin/my-analytics-panel-says-ai-assistants-are-desperate-for-wp-configphp-3lae",
  "papers": [],
  "actual_video_files": [],
  "body_chars": 3584,
  "expected_body_images": 0,
  "discovery_status": "ok",
  "delivery_status": "ok",
  "missing_reason": "",
  "raw_html": "attachments/5a25c1eed2b4/pages/source.html",
  "local_html": "attachments/5a25c1eed2b4/pages/article.html",
  "body_base_path": "attachments/5a25c1eed2b4/pages/",
  "body_markdown_path": "attachments/5a25c1eed2b4/pages/article.md"
}