That will only find either clumsy exploit attempts or whitehat scans that are not trying to hide themselves. CGI sends most headers through to the script as en

That will only find either clumsy exploit attempts or whitehat scans that are not trying to hide themselves. CGI sends most headers through to the script as environment variables (i.e. a Foobar: header will turn into $HTTP_FOOBAR) so at attacker can just pick a header name that isn't likely to be logged.