Why isn't this .htaccess file working?

Question

Recently, my website was hammered with thousands of POST requests from various bots.

Instead of taking the approach of blocking these bots based on their user agent, I've decided to find a way to block all POST requests sent to my website and allow all POST requests from within my website.

I came up with the following:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_HOST} !.*mydomain.com.*
RewriteRule ^.* - [F,L]

but for some reason it doesn't work. Any ideas?

Thanks!

Answer 1

If you're looking for people that did not come from mydomain.com during a POST, then what you want is %{HTTP_REFERER} not %{HTTP_HOST}. HTTP_HOST is the Host: header from the HTTP/1.1 request the client made, which could be useful if the bots were just hitting your IP without bothering to look up the hostname of your website. For examples of using %{HTTP_REFERER} take a look at this forum post on "hotlinking" protection... one thing to note from the hotlinking protection examples is that your REFERER check should include the entire starting part of the URL, otherwise someone could register "mydomain.comasdfjkl.com" or just set up a page on their website "example.com/mydomain.com.html", either of which would match your current condition.

In reality, though, the Referer: field is easy to forge, and there are a number of people that disable Referer for privacy reasons who would no longer be able to use POST forms on your website. It might make for a good first line of defense, but if your goal is to protect a form from spambots, you'll want to do more.

If you're trying to protect a form written in PHP or some other language that can use sessions, you could defeat some bots simply by setting a flag in the session when the blank form is loaded, then erasing the flag when the form is saved (rejecting the form if the flag was not set). This would require that the bot get a session cookie, load the blank form then finally save the form, in that order. You'll lose the people who don't trust you with a session cookie, but you'll gain protection from dumb bots and people accidentally hitting reload after submitting the form and resubmitting it.

Answer 2

I'm not an expert in rewrite rules, but going back one step - make sure your Apache directory conf does not have

AllowOverride None

as it will disable your .htaccess entirely.