Yeah, probably jdiction don´t have anything with this, but the least I can do is asking

would you elaborate that php hardener you are talking about?
About the access.log, I´m receiving something like a redirection bucle there, something like "domain.com/de/de/de/de", where de is a installed but not public language. Have you found something similar?