These paths are likely malicious bot probes and not legitimate traffic which are aimed to exploit vulnerabilities on your website.
We see these patterns in hundreds on our sites and can block these. However, the nature and path keep changing and is hard to track. The best remedy is to keep the sites up to date.
Usually the HTTP to HTTPS redirect happens before WP ever gets the request, so there’s no way for WP to track which were initially HTTP requests. The redirect is typically by .htaccess directives.
Unless you have a specific need to track HTTP only, I don’t see why differentiation would be necessary.
Unfortunately, I don’t know which plugin you are referring to. However, the list of URLs you mentioned suggests that it also records bot access to non-existent URLs. These are also 404 errors, but they are also potential attack attempts because they try to find out whether the URLs exist on your site in order to exploit a security vulnerability in a second step. For example, by accessing a plugin directory of a plugin that has known security vulnerabilities.
You can never rule out this type of access. It exists and you will see it again and again. It may help to secure access before it reaches WordPress. Cloudflare or security tools from your host could help – but they could also cause other problems.
I would recommend simply ignoring it. If you are looking for other options, contact the support team for the plugin you are using that is displaying this list.
