I'm new to web security and recently deployed my first small website through Netlify. It's only a static HTML, CSS, and JavaScript project, without a backend or anything particularly sensitive. While looking at the site's observability data, I noticed 12 requests from the same IP over about five minutes. The IP appeared to belong to a Tor exit node. Most requests were just for "/", "/favicon.ico", or a single PNG/JPG file matching the favicon. They also had relatively high latency. Normally, scrolling through the site would trigger requests for additional lazy-loaded images, but those requests never appeared. Could this have been a real person, a company, or some kind of automated crawler or scanner? I'm not especially worried, but I'd like to understand what this traffic pattern might mean and what basic precautions I should take.
3 Answers
If the site is entirely static and has no backend, database, uploads, or exposed credentials, there’s very little for someone to compromise. You can use a CDN or security proxy such as Cloudflare if the traffic becomes annoying, and a robots.txt file may help with well-behaved crawlers. Just remember that robots.txt won’t stop scanners that ignore it, and you generally don’t need to react to a few isolated requests.
This is most likely automated traffic. Search crawlers, monitoring tools, and simple scripts routinely request the homepage and favicon without loading the page like a normal browser. Since the additional images were never requested, it probably didn’t behave like someone manually browsing and scrolling. A Tor exit node only tells you that the traffic came through a shared Tor relay; it doesn’t identify the person or organization behind it. On a static site, there usually isn’t much to attack, but make sure you never put API keys, tokens, or other secrets in client-side JavaScript—anything sent to the browser should be treated as public.
That makes sense. I’ve seen requests from other countries too, but this one stood out because of the Tor connection and the limited file requests. I’ll review the JavaScript to make sure nothing sensitive is exposed.
It could be a crawler, a basic scanner, or just a script making low-effort requests. The pattern alone doesn’t indicate anything targeted or malicious. Twelve requests over five minutes is very small-scale, and bots often request only "/" and "/favicon.ico". Tor is sometimes used for privacy-focused crawling or probing, but it can also be random background noise. Keep backups, review your request logs occasionally, and focus on repeated patterns over days or weeks rather than trying to interpret one short burst.
It’s also worth checking your own code and network requests, especially asynchronous functions and lazy-loading logic, so you know which files should normally be requested. That can help distinguish expected browser behavior from simple automated hits.