The file we called broken

There is a file in this project's image folder called stats2.gif. It is 366 bytes, dated March 2018, and it appears in exactly zero lines of source code. On 23 August 2026 it was served 2,735 times with a 200, from 145 different websites — and over the full rotation of the access log, from 858.

A file nobody references, fetched thousands of times a day from hundreds of strangers' pages. The obvious reading: an old embed that people never replaced, quietly serving a static image where a counter used to be. Static files bypass PHP entirely. Nothing that reaches Apache directly can count anything.

So we wrote a tool. It reads every referring page out of the log, fetches each one through the same checker the site already uses for embed diagnostics — with its SSRF guards, because those addresses come from a log and not from us — and looks for whether anything on the page actually counts.

All 858 pages

already counting (a working embed alongside)	501
not reachable at all	288
badge present, no counter number in the source	69
only the old badge, nothing counting	0

Not one. Seventy-five minutes of fetching to find nothing.

The measurement that would have taken one second

stats2.gif is 13 by 14 pixels.

That is not a counter and not a badge with a number on it. It is the small statistics icon — the same thing design 981 in the current gallery recreates, and that design's own source comment describes its ancestor precisely: no visible count, just a small mark that opens your statistics when clicked. It was never supposed to count. On those pages, something else always did.

The file is not broken either. It answers 200 with a Last-Modified from 2018 and a year of cache lifetime. It does its job.

One call to getimagesize() at the start would have ended the whole line of inquiry before the tool was written. Instead the question was "why is this file fetched so often" and the answer assumed was "because it is a broken counter", and everything after that followed from an assumption nobody checked.

The one thing that really is broken

Out of all of it, the log showed a single genuine defect: one address, requested ten times a day, all 410, where an entire embed snippet had ended up inside the link's href. Somebody pasted the code into a field that escapes HTML. Their counter is alive and counting — only their own link to their own statistics leads nowhere.

The tool stays, without its write path. The question was legitimate; the answer is no; and both are worth keeping so nobody has to ask it by hand again.