Htaccess: Banning certain IP addresses from accessing your site

Banning certain IP addresses from accessing your site

Whatever the reasons are, sometimes you may want to ban certain IP addresses from accessing your website(s). This can easily be achieved by adding the following lines to your .htaccess file (replace IP with the IP address you want to ban from accessing your site, f.ex. 123.33.64.1):

order allow,deny
deny from IP
allow from all

Of course, you can specify more than one IP addresses and also C or B class IPs - this way you would ban all IPs from the entire class. F.ex. deny from 125.30.5. would ban all the IPs that start with 125.30.5. (125.30.5.1, 125.30.5.2, etc ...). Add one IP per line in your .htaccess file like this:

order allow,deny
deny from 125.30.5.1
deny from 125.30.5.
allow from all

Instead of banning by IP, you can also block access to your site by referring URL

Blocking users/ sites by referrer:

Blocking users or sites that originate from a particular domain is another useful trick of .htaccess. Lets say you check your logs one day, and see tons of referrals from a particular site, yet upon inspection you can't find a single visible link to your site on theirs. The referral isn't a "legitimate" one, with the site most likely hot linking to certain files on your site such as images, .css files, or files you can't even make out. Remember, your logs will generate a referrer entry for any kind of reference to your site that has a traceable origin.

Before I get to the code itself, it's important to note that blocking access by referrer in .htaccess requires the help of the Apache module mod_rewrite to make out the referrer first. This module is installed by default on most servers (ask your host if you're not sure). So, to deny access all traffic that originate from a particular domain (referrers) to your site, use the following code:

Block traffic from a single referrer:

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} badsite\.com [NC]
RewriteRule .* - [F]

Block traffic from multiple referrers

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} badsite\.com [NC,OR]
RewriteCond %{HTTP_REFERER} anotherbadsite\.com
RewriteRule .* - [F]

In the "single referrer" case above, "badsite\.com" is the domain you wish to block. Note the backslash proceeding the period (".") to actually donate a period, as in Regular Expressions, a period donates any character, which is not what we want. The flag "[NC]" is added to the end of the domain to make it case insensitive, so whether the domain is "badsite.com", "Badsite.com" etc, however bad it gets, it gets blocked. Finally, the last line in the .htaccess file specifies that the action to take when a match is found is to fail the request, meaning the referrer traffic will hit a 403 Forbidden error. The only difference between blocking a single referrer and multiple referrers is the modified [NC, OR] flag in the later case to every domain but the last.

Now, you may have noticed the line "Options +FollowSymlinks" above, which is commented. Uncomment this line if your server isn't configured with FollowSymLinks in its section in httpd.conf, and you get a 500 Internal Server error when using the code above as is

This article was taken from: easytutorial javascriptkit