Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently, my website was hammered with thousands of POST requests from various bots.

Instead of taking the approach of blocking these bots based on their user agent, I've decided to find a way to block all POST requests sent to my website and allow all POST requests from within my website.

I came up with the following:

RewriteEngine on
RewriteCond %{HTTP_HOST} !.**
RewriteRule ^.* - [F,L]

but for some reason it doesn't work. Any ideas?


share|improve this question
up vote 3 down vote accepted

If you're looking for people that did not come from during a POST, then what you want is %{HTTP_REFERER} not %{HTTP_HOST}. HTTP_HOST is the Host: header from the HTTP/1.1 request the client made, which could be useful if the bots were just hitting your IP without bothering to look up the hostname of your website. For examples of using %{HTTP_REFERER} take a look at this forum post on "hotlinking" protection... one thing to note from the hotlinking protection examples is that your REFERER check should include the entire starting part of the URL, otherwise someone could register "" or just set up a page on their website "", either of which would match your current condition.

In reality, though, the Referer: field is easy to forge, and there are a number of people that disable Referer for privacy reasons who would no longer be able to use POST forms on your website. It might make for a good first line of defense, but if your goal is to protect a form from spambots, you'll want to do more.

If you're trying to protect a form written in PHP or some other language that can use sessions, you could defeat some bots simply by setting a flag in the session when the blank form is loaded, then erasing the flag when the form is saved (rejecting the form if the flag was not set). This would require that the bot get a session cookie, load the blank form then finally save the form, in that order. You'll lose the people who don't trust you with a session cookie, but you'll gain protection from dumb bots and people accidentally hitting reload after submitting the form and resubmitting it.

share|improve this answer
Thanks, that makes sense. – Zero Oct 27 '10 at 22:23
Since we're on the topic of security, should I use Options None for better security? – Zero Oct 27 '10 at 22:26

I'm not an expert in rewrite rules, but going back one step - make sure your Apache directory conf does not have

AllowOverride None

as it will disable your .htaccess entirely.

share|improve this answer
Thanks, it doesn't have that entry. – Zero Oct 27 '10 at 22:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.