I keep on seeing cgialfa on 404

I am hacked or just being tried?

Possibly.

A Google search for alfacgi brings up this TrendMicro blog post and this www.ads-software.com support forum topic about some “Alfa-Shell” malware.

What should you do? Let me quote Stephen’s advice in the WordPress support forum post linked above:

Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

Good luck!

But its on a 404 list, meaning something tried to find these files but they weren’t there. Correct?

Probably.

It doesn’t hurt scanning your site though… and taking proactive steps to harden the site if you don’t have adequate protection in place already.

Yes, I will take care of that. TYSM for your time & help. Have a great day ahead.