How to access raw access logs in HostGator

Every request to a HostGator-hosted website creates a small record containing the visitor’s IP address, the requested resource, and the server’s response. These records are stored as raw access logs. They give you a request-by-request history that can reveal traffic spikes, failed requests, suspicious scans, and visits to pages that analytics tools may overlook.

Raw logs differ from error logs. An error log focuses on requests that generated a problem, while a raw access log captures successful and unsuccessful requests together. This broader view is useful when checking whether a visitor reached a checkout page, whether an image returned a 404 error, or whether repeated requests came from an automated bot rather than a genuine customer.

Australian websites add a few useful wrinkles. A business may use a .com.au domain while serving customers through the NBN, and requests can arrive from connections associated with providers such as Telstra, Optus or Aussie Broadband. Log timestamps may also differ from Australian local time. Sydney and Melbourne change between AEST and AEDT, while Brisbane remains on AEST, so check the server timezone before matching requests to an Australian event.

Log files can contain personal information, including IP addresses and the pages a visitor requested. Under the Australian Privacy Act 1988, IP addresses may be considered personal information in some circumstances. Keep raw logs restricted, avoid publishing them, and remove details that are unnecessary when sharing evidence with your web host or another service provider.

What raw access logs record

A typical entry contains several pieces of information. The IP address identifies the network making the request; the date and time show when it arrived; the request line records the HTTP method, path and protocol; and the status code indicates what happened. Other fields may show the response size, referring page, and browser or crawler user agent.

These details help separate normal browsing from automated activity. For example, hundreds of requests to a login page in a few minutes may indicate a password attack, while requests to an XML sitemap can represent a legitimate search engine crawler. Background information about the provider’s customer experience can also be found in independent HostGator reviews.

Raw logs are most useful for investigating a defined question. You might need to determine whether a page was requested before it disappeared, identify the source of a server error, or check whether a campaign produced visits from Australian regions. They work best alongside hosting statistics, WordPress analytics and application logs rather than replacing them.

Sign in and open the log viewer

Start by signing in to the HostGator customer portal and opening the cPanel for the relevant hosting account. Use the same credentials that you use for the HostGator control panel unless you have a separate cPanel login. If the account contains several domains, confirm that you are opening the cPanel attached to the site you want to investigate.

In cPanel, use the search box for “Raw Access” or open the Metrics section and select Raw Access. The exact position can vary slightly between cPanel versions, but the purpose of the page is to let you choose a domain and open its request history. Some accounts label the feature “Raw Access Logs” or place it alongside other log tools.

Choose the correct domain from the selector and click Go. The log should open in a separate browser tab or within the cPanel viewer. If you have changed the primary domain recently, check both the new domain and the previous domain because each can have its own access history.

Interpret the entries

Begin with the request path and status code. Common codes include 200 for a successful response, 301 or 302 for a redirect, 304 for a cached response, 403 for a blocked request, 404 for a missing file, and 500 for a server error. A large number of 404s can reveal broken links, while repeated 403 or 500 responses may point to a security rule, plugin fault or resource problem.

The user agent can reveal broad types of clients, such as Chrome, Safari, a crawler, or a monitoring service. It is not completely reliable, because automated tools can imitate browsers and some genuine requests may have unusual user agents. Look for patterns across several fields rather than making a decision from one line.

Timestamps require particular care in Australia. Check whether the viewer uses UTC, the hosting server’s timezone, or another configured zone. During daylight saving time, Sydney and Melbourne move from UTC+10 to UTC+11, while Brisbane remains at UTC+10. A request displayed in server time may therefore appear to occur at a different hour from the one shown in your local campaign or security report.

Download and store the file

Look for a Download Raw Access Logs button or download icon in the viewer. If the current file is available, save it before investigating so that new requests do not change the evidence. A compressed archive may be provided when the log is large, while older rotated files may appear through a date selector or a separate download list.

Give the file a date-based name, such as 2025-03-08-access.log, and store it in a restricted folder. Include the relevant Australian date and timezone in your notes, especially when comparing the file with monitoring alerts. Keep the original unchanged and perform any filtering on a copy so that important request lines remain intact.

Log rotation affects how far back you can search. HostGator may archive and remove older raw logs according to the retention settings associated with the account. If an incident occurred weeks ago and the viewer no longer contains that period, ask HostGator support whether archived files remain available rather than assuming the earlier traffic never existed.

Protect the account and log data

The raw log viewer sits inside the same control panel used to manage billing, domains and websites. Give it the same protection as the rest of your account: use a unique password, store credentials in a password manager, and sign out on shared computers. It is also sensible to enable two-factor authentication using the provider’s two-factor authentication guide.

Treat downloaded logs as sensitive records. They may expose customer IP addresses, internal file names, query parameters, email addresses embedded in URLs, and authentication errors. Do not attach an unrestricted log to a public forum, issue tracker or social media post. If the file must be shared with a developer or security specialist, restrict access and provide only the date range and entries required for the task.

When asking HostGator support to investigate suspicious activity, include the domain, approximate time, affected path and relevant status codes. Never include your password or full recovery codes. A short, redacted excerpt is usually enough for support staff to verify the issue while reducing the amount of personal information circulating.

Fix common access problems

If Raw Access is missing from cPanel, first search for “logs” and check whether your hosting plan includes the viewer. Account permissions, an unusual cPanel layout or a temporary control panel fault can also hide the menu. Search the HostGator knowledge base, then open a support ticket if the feature remains unavailable. Describe the plan and affected domain, but leave passwords out of the request.

A blank log usually means that no matching requests are available for the selected period. It can also occur when you select the wrong domain, the site has only just been created, or all recent responses are being served through a cache or content delivery network. Check the domain selector and compare the period with cPanel’s traffic statistics before escalating the issue.

Large files may open slowly, and some older entries may no longer exist because of automatic rotation. Download a smaller date range where possible and use a text editor or command-line tool to search it. If another login produces a permission error, verify that the account owns the domain and that domain mapping is complete. These checks follow the broader HostGator security practices that reduce unnecessary account access.

Check traffic against Australian conditions

Compare the log with the purpose of the website and the period being examined. An Australian online store might show a burst of requests during a Melbourne promotion, while a .com.au service may receive crawlers visiting pages that no customer sees. Requests associated with Australian internet providers are not automatically suspicious; the path, timing, status and repetition matter more than the network alone.

Look for signs that distinguish automation from genuine use. Search engine crawlers often revisit sitemap and canonical URLs regularly, whereas scanners may probe wp-login.php, .env, database files or uncommon paths. A genuine visitor usually requests a sequence of content, images and checkout resources. Multiple failed requests to restricted endpoints from the same address require closer attention.

Cross-check unusual entries against server analytics, firewall reports, WordPress activity and application logs. Analytics can exclude bots and use its own time-zone rules, while raw logs contain every request delivered to the web server. When the two disagree, the request path and exact timestamp often reveal whether caching, a redirect, bot filtering or a timezone conversion caused the difference.

Keep a concise record of the domain, Australian date range, server timezone, affected pages and the pattern you observed. Preserve the original file, note the status codes and avoid exposing visitor details. That record makes it easier to compare the activity with HostGator support or to repeat the investigation after a configuration change.

A useful review connects each suspicious pattern to a specific response: block confirmed abuse, repair broken paths, adjust the affected application, or document why the traffic is harmless. Avoid changing several settings at once, because that makes it harder to identify which action changed the incoming requests.

The immediate next step is to open the HostGator cPanel, select the affected domain under Raw Access and download the latest file as YYYY-MM-DD-access.log.