Sometimes bots or other bad actors may request pages looking for exploits. For example, bots often target .php URLs in hopes of finding Wordpress exploits.

You can add a Caddy route to your application to match these requests and return a 404 response.

@php path *.php
respond @php 404

To learn more, check out Caddy's respond and matcher docs.