I noticed the following log entry: - - [13/Mar/2015:08:31:00 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 618 "https://cap5.nl/veiligheidstips-en-voorkom-hacken-van-je-wachtwoord/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36"

It is my company website and guaranteed that nobody (including me) was logged in, or using the dashboard. Shouldn't a /wp-admin/.. POST return a 404 or 403 instead of a 200?

Any tips are welcome!

Kind regards,


1 Answer 1


wp-admin/admin-ajax.php is the script used by any plugin or theme using WP Ajax API and Ajax actions can be registered for non-logged in users. For example:

//For logged in users
add_action( 'wp_ajax_my_action', 'my_action_callback' );
//For non-logged in users
add_action( 'wp_ajax_nopriv_my_action', 'my_action_callback' );

There is no problem on that. See WP Ajax documentation for more information.

  • Good to know, thanx a lot @cybmeta .. I have a log monitor that loosely watches activity on sites based on /wp-admin/ urls in the access log ... Planning on incorporating Heartbeat API in a plugin for this so the log filter can be removed. Goodluck and thanx again
    – GerardJP
    Mar 13, 2015 at 16:19
  • 1
    sorry, done! :)
    – GerardJP
    Mar 13, 2015 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.