Web logs are server records that capture activity on a website, such as request time, source IP address, URL path, HTTP method, status code, user agent, and sometimes authentication or application errors. They are created by web servers, reverse proxies, load balancers, and security tools such as a WAF.
In cyber security, web logs are a basic source of evidence. They help defenders verify who accessed a site, what pages or endpoints were touched, and whether requests look normal or suspicious. Attackers often leave traces in these records when they scan for weaknesses, brute-force login pages, exploit input fields, or probe for hidden files. Analysts use web logs to spot unusual spikes in traffic, repeated failures, strange user agents, abnormal POST requests, or access from unexpected locations. Good logging, retention, and review can turn a vague alert into a clear timeline of activity.