Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is the a way I can have Apache return a 500 status when it receives a request from a particular (malicious) user agent?

share|improve this question
Sure, just arrange for your application to crash when it receives such a request. You should consider returning a more reasonable error such as 403 instead. – Michael Hampton Sep 26 '12 at 2:51
The point is to disuade malicious vulnerability scanning. The idea is to respond unreasonably, be it forbidden or server error (server error is preferable as it provides the impression the server isn't able to respond effectively). – daaa Sep 26 '12 at 2:59
You dissuade vulnerability scanning by putting criminals in prison. You protect your web site by reading this. – Michael Hampton Sep 26 '12 at 3:02
Sorry, but if you put a 500 error in front of a vulnerability scanner, whoever is running it is going to think your app is so badly written that it'll be easy to get in. You will attract unwanted attention. – Michael Hampton Sep 26 '12 at 3:05
@daaa, you've got a reasonable answer now. You might do better editing the question to, "Can I have Apache return an arbitrary error code..."? – pjmorse Oct 6 '12 at 10:38

Yes, you can do it with the mod_rewrite module. The following entry will return a 403 Forbidden response to clients with the text "Opera" or "MSIE" in their user agent strings regardless of text case.

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} Opera [NC]
RewriteRule ^.* - [F,L]

If you'd rather return 500 Internal Server Error change the F to R=500 at the end of the RewriteRule directive.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.