The default system.performance:fast_404.paths pattern now also matches php, json, xml, zip, sql, gz, tar and bak. Requests for non-existent files with these extensions now get the lightweight Fast 404 response instead of a fully rendered 404 page, which reduces the cost of automated vulnerability scans.
New sites get the new default. Existing sites that still use the previous default are updated automatically by system_post_update_fast_404_paths(). Sites that have customised fast_404.paths, either in configuration or in settings.php, are not changed.
To add the new extensions to a customised pattern, update it in configuration or in settings.php, for example:
$config['system.performance']['fast_404']['paths'] = '/\.(?:txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp|php|json|xml|zip|sql|gz|tar|bak)$/i';
Before
A request for a missing file such as /wp-login.php returned a fully themed 404 page.
After
The same request returns the minimal Fast 404 HTML.
