Block based on Referer

[edwurster]

I've been reading about blocking incoming requests based on Referer. I'd like to do this for any referer that contains a certain word, such as "wild". I've read too many pages about this, and just need an answer.

The word I'm trying to match comes after the tld. For example:

http://anydomain.com/*wild*.*

[midwest]

RewriteCond %{HTTP_REFERER} ^http://.*\..*/.*wild.*$ [NC]

I dont suggest using this way as it will block things like domain.com/bewilder.htm
not what you probably want.

[edwurster]

Originally Posted by midwest

RewriteCond %{HTTP_REFERER} ^http://.*\..*/.*wild.*$ [NC]

I dont suggest using this way as it will block things like domain.com/bewilder.htm
not what you probably want.

Thanks Ronnie. I needed a big hammer, and understand it is not a great solution.

[edwurster]

Originally Posted by midwest

RewriteCond %{HTTP_REFERER} ^http://.*\..*/.*wild.*$ [NC]

I dont suggest using this way as it will block things like domain.com/bewilder.htm
not what you probably want.

RewriteCond %{HTTP_REFERER} (somespammer\.com) [NC,OR]
Is this valid as written?

[midwest]

no,
RewriteCond %{HTTP_REFERER} ^http://somespammer\.com$ [NC,OR]

[edwurster]

Will this work in an htaccess file?

SetEnvIfNoCase Referer poker spammer=yes
deny from env=spammer

Seems to be much simpler than rewritecond.

[midwest]

Looks right to me.

[edwurster]

Originally Posted by midwest

Looks right to me.

My htaccess:

SetEnvIfNoCase Referer poker spammer=yes
deny from env=spammer

<Files 403.shtml>
order allow,deny
allow from all
</Files>

Is this sending the denied visitor to my 403 page?

Thanks Ronnie.

[midwest]

ErrorDocument 403 /403.shtml
SetEnvIfNoCase Referer .*poker.* spam
Order Allow,Deny
Deny from env=spam

The above would wiork as you want I think.
but you should know,
The earlier examples used mod_rewrite,
this example uses mod_access

[edwurster]

Originally Posted by midwest

ErrorDocument 403 /403.shtml
SetEnvIfNoCase Referer .*poker.* spam
Order Allow,Deny
Deny from env=spam

The above would wiork as you want I think.
but you should know,
The earlier examples used mod_rewrite,
this example uses mod_access

It will take me a while to understand all of this. Until then, could you explain the purpose of:

<Files 403.shtml>
order allow,deny
allow from all
</Files>

This is what CPANEL put in htaccess when I used CPANEL to edit a 403 error page.

[midwest]

It is using htaccess to set your 403 error page. In this case your page is in your root.
You could as easily use
<Files index.shtml>
order allow,deny
allow from all
</Files>
to send 403's to your index page.