[FEAT] Default site returns 200 for unknown paths, so nginx-botsearch never matches #631

Is this a new feature request?

• I have searched the existing issues

Wanted change

Hi,

the default site should return 404 for paths that don't exist. Right now it falls back to /index.html and returns 200 for everything.

Reason for change

I wondered why fail2ban never banned the scanners hitting my server. The nginx-botsearch jail only matches requests with a 404:

failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/<block> \S+\" 404 .+$

But the default site has

try_files $uri $uri/ /index.html /index.htm /index.php$is_args$args;

so every unknown path gets the landing page with 200:

"GET /.ssh/id_rsa HTTP/1.1" 200 1345 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
"GET /%2egitconfig HTTP/2.0" 200 1345 "-" "curl/8.7.1"

In my access log that happened 5282 times, and the jail matched only 21 of 373440 lines. My default.conf is the unchanged sample (2026/03/07).

Proposed code change

try_files $uri $uri/ =404;

/ still shows the index.html. If the fallback is there on purpose (php apps in /config/www), maybe add a comment in the sample that nginx-botsearch doesn't work for the default site then.