This access log analyzer reads an Apache, Nginx, LiteSpeed, cPanel or DirectAdmin access log and shows you who is hitting the site: top IP addresses, URLs, user agents and status codes, bots, WordPress login and XML-RPC floods, vulnerability scanner probes, and the busiest minutes. Open a .log or .gz file or paste lines. Everything runs in your browser and nothing is uploaded, which matters because access logs contain visitors’ IP addresses.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
What the access log analyzer shows
- Totals: requests, unique IPs, data sent, 4xx and 5xx rates, the share of bots and scripts, the time span and requests per minute.
- What stands out: WordPress brute force (IPs over your POST threshold on
wp-login.phporxmlrpc.php), scanner probes, a high 5xx rate, and a minute with more than five times the average traffic. - Top lists of IP addresses, URLs, status codes, bots, user agents, 404 URLs, 5xx URLs, scanner probes, referring sites, virtual hosts and HTTP methods.
- Busiest minutes, with the top IP in each one, which is usually enough to find what caused a load spike.
- CSF block commands for flooding IPs, to review and copy, plus a plain-text summary for a ticket or email.
Supported log formats
Any log in the NCSA combined or common format, with or without a leading vhost:port (Apache’s vhost_combined). That covers the default logs of Apache, Nginx (combined/main), LiteSpeed and OpenLiteSpeed, cPanel domlogs and DirectAdmin domain logs. Lines in other formats are counted as “not recognised” and the first few are shown, so you can see what was skipped.
| Server | Where the access logs are |
|---|---|
| cPanel | /var/log/apache2/domlogs/DOMAIN and DOMAIN-ssl_log; archives in /home/USER/logs/ |
| DirectAdmin | /var/log/httpd/domains/DOMAIN.log |
| Debian/Ubuntu Apache | /var/log/apache2/access.log |
| Nginx | /var/log/nginx/access.log |
For every other log on these systems, see Linux server log file locations.
Get the log onto your computer
# Last 50,000 lines of one site's log, compressed (cPanel example)
tail -n 50000 /var/log/apache2/domlogs/example.com-ssl_log | gzip > /root/example-ssl.log.gz
# then download it with scp or SFTP:
scp root@server:/root/example-ssl.log.gz ..gz files are decompressed in the browser (current Chrome, Edge, Firefox and Safari). Delete the copy on the server when you are done.
How we tested it
On 11 October 2026 we ran the analyzer in Chromium with real access logs from our three lab servers (a cPanel domlog with 1,384 lines, a Debian Apache log with 4,295 lines over 2.3 days, and a DirectAdmin domain log), with a generated log containing a WordPress login flood, an XML-RPC flood and scanner probes (plain and .gz), and with pasted lines. It found both flooding IPs, flagged probes for /.env, /.git/config and eval-stdin.php, and on the real cPanel log showed 16 scanner IPs and a minute with 277 requests. A generated 500,000-line log (69 MB, 7 MB gzipped) took 3.5 seconds and about 200 MB of browser memory.
Reading the results
WordPress login and XML-RPC floods
Dozens of POSTs to wp-login.php or xmlrpc.php from one IP is a password-guessing attack. The CSF commands the tool prints are a starting point: check each IP first. If the site is behind Cloudflare or another proxy, the log may show the proxy’s IPs, and blocking those blocks real visitors; see real visitor IPs behind Cloudflare. For a lasting fix, see fail2ban vs CSF.
Scanner probes
Requests for /.env, /.git/, wp-config.php backups or phpMyAdmin come from automated scanners. A 404 is the right answer. A 200 means the file exists and is readable: remove it or block it at once.
Bots
Bots are grouped by user agent, which anyone can fake. To check whether a “Googlebot” is real, run host IP: Google’s crawlers resolve to googlebot.com or google.com, and the name resolves back to the same IP.
Busiest minutes
Match the busiest minute against the server’s load history (atop and sar) to see whether the traffic caused the slowdown. If one IP dominates that minute, it is your main suspect.
On the command line instead
# Top 10 IPs
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head
# Top 10 URLs with a 404
awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn | head
# POSTs to wp-login.php per IP
grep 'POST /wp-login.php' access.log | awk '{print $1}' | sort | uniq -c | sort -rn | headThese assume a plain combined log without a vhost prefix. For regular reports, use GoAccess. To check every site on a server at once, use our web log top IPs script. To have an error line explained, use the AI log analyzer.
Frequently asked questions
Is my log file uploaded to your server?
No. The analyzer runs entirely in your browser with JavaScript; the file is read locally and nothing is sent anywhere. You can disconnect from the internet after the page has loaded and it still works.
Which log formats does the access log analyzer support?
The combined and common log formats, with or without a vhost:port prefix. That covers the default access logs of Apache, Nginx, LiteSpeed, OpenLiteSpeed, cPanel domlogs and DirectAdmin domain logs.
Can it read .gz log files?
Yes, in current browsers that support DecompressionStream (Chrome, Edge, Firefox and Safari). Older browsers ask you to unzip the file first.
How big a log can it handle?
In our test, a 500,000-line log (69 MB uncompressed) took 3.5 seconds in Chromium. Files are read in chunks; very large files are limited by your computer’s memory.
How do I find who is attacking my WordPress login?
Open the site’s access log in the analyzer. IPs with many POST requests to wp-login.php or xmlrpc.php are listed under WordPress login and XML-RPC floods, with CSF block commands you can review and copy.