Skip to content

ivan

Resume

Block Unwanted Visitors To Your Website With .htaccess

Unwanted visitors won’t bring you any good or benefit. Unwanted visitors may harm your website or server and waste your money indirectly. And since they don’t bring you any benefit and may cause harm to your server that will affect your loyal visitors/readers, we need to block them.

So who are the unwanted visitors? Here are some of them:

  1. Scrape bot
  2. Vulnerable finder bot
  3. Spam bot
  4. Unknown spider/crawling bot
  5. DDoS attack

Those bots don’t do anything good for you — they steal content, inject malicious code, spam your comment box, and crawl your website for nothing. They just waste your bandwidth, increase server load, and slow down your server, which may cause a worse experience for your loyal visitors. This should be stopped.

You should stop those kinds of visitors — you don’t need them. To block them you can use .htaccess.

To block by IP addresses:

<limit GET,POST>
order allow,deny
deny from xxx.xxx.xxx.xxx
allow from all
</limit>

To block by specific ISP:

<limit GET,POST>
order allow,deny
deny from some-evil-isp.com
allow from all
</limit>

To block by spider name:

<limit GET,POST>
order allow,deny
SetEnvIfNoCase User-Agent "libwww-perl" bad_bot=1
deny from env=bad_bot
allow from all
</limit>

To block by user agent:

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^First_string_here [OR]
RewriteCond %{HTTP_USER_AGENT} ^Another_string_here [OR]
RewriteCond %{HTTP_USER_AGENT} ^Last_string_here
RewriteRule ^(.*)$ http://your.domain.com/custom_error_page.html

To see the visitor’s IP address, user agents, or spider name you can look in your access_log. Or in WordPress you can install the Statpress plugin to see your visitors’ details and statistics. If you see something unusual, just block them. You don’t need such visitors.