Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server is under a heavy attack. Most requests are coming this way: - - [15/May/2012:11:21:45 +0400] "GET / HTTP/1.0" 200 65859 "" "Mozilla/4.0 (compatible; MSIE 4.01; b o t)"

The HTTP protocol version is same for all such requests. Can I block HTTP 1.0 requests on a web server level somehow? I have tried this to eliminate the attack (redirect to an empty file):

if ($server_protocol ~* "HTTP/1.0") {
    rewrite ^/;

Does not seem to help much, I don't see any such redirects in the logs. I use nginx 1.0.9 as a reverse proxy with Apache 2.2.3.

Any help is appreciated.

share|improve this question
up vote 6 down vote accepted

You could use something like this

if ($http_user_agent ~* "" ) {
    return 444;

444 will close the connection without returning anything, assuring the lowest possible impact. Though if you want to inform possible legitimate users, use something like 400 perhaps.

Additionally, perhaps block by referrer, though most bots will easily spoof that too.

As far as blocking entire HTTP 1.0 is concerned, you should check this first. If you'd still like to implement the block as a temporary solution, something like this should work.

if ($server_protocol ~* "HTTP/1.0") {
    return 444;

Basically the same thing you had, except with no rewrite - if I'm reading it right, your usage made it just stay in a permanent loop.

share|improve this answer
But they send all requests with a uniq user agent header. What do I do on this matter? You advice is very promising. – Andrew May 15 '12 at 8:09
You can download it here: That you very much. – Andrew May 15 '12 at 8:49
Fixed up the answer so it actually makes sense. But still, take blocking HTTP 1.0 as the last resort, any only temporary, since there's a chance you might block normal users, as low as it is. Rather identify recurring/related source IPs/user agents/referrers and block on that. – Sašo May 15 '12 at 9:15
Thank you. Yes, it will be a permanent block, of course. – Andrew May 15 '12 at 9:29

Use the right variable: $server_protocol instead of $http_user_agent.

share|improve this answer
Thanks, but it was just a typo. I've corrected my original post. – Andrew May 15 '12 at 8:06

This worked for me with Nginx 1.8.

if ($server_protocol = HTTP/1.0) {
    return 444;

My reason for doing it was different. The Qualys Threat Report detected CVE-2000-0649, "allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request", on my server. I have the liberty of doing this because our site only supports limited browsers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.