Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to deny some user agents I constantly see probing my nginx web server.

If I have this in my .conf file

 ## Block http user agent - morpheus fucking scanner ##
    if ($http_user_agent ~* (morfeus fucking scanner|ZmEu)) {
       return 403;

I get the following error when starting services:

nginx: [emerg] invalid condition "$http_user_agent" in /etc/nginx/sites-enabled/siteXXX:19
nginx: configuration file /etc/nginx/nginx.conf test failed

If I place quotation marks around it, it starts but doesn't deny as I would expect it to.

 ## Block http user agent - morpheus fucking scanner ##
    if ($http_user_agent ~* "(morfeus fucking scanner|ZmEu)") {
       return 403;

Any ideas? Im looking for a case-insensitive user agent deny.

share|improve this question
up vote 8 down vote accepted

Just drop the brackets and add quotes:

if ($http_user_agent ~* "morfeus fucking scanner|ZmEu") {
    return 403;
share|improve this answer

what is the string you are trying to match?

Regex should be in quotes, but if you want to match regex special symbol (,),| - you need to escape it with \

try this: $http_user_agent ~ "(morfeus fucking scanner)|ZmEu"

share|improve this answer
The two strings are "morfeus fucking scanner" and "ZmEu" (both without quotes). If either of these user agents try to hit the webserver, I want to send them a 403 response. I've been reading this article and this translated message thread both indicate Im setup correctly.... but not having a good time. – ProfessionalAmateur Feb 14 '13 at 3:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.