I'd like to dynamically add IPs to a block list via htaccess. I was hoping someone could tell me if the following will work in my case (I'm unsure how to test via localhost).

My .htaccess file will have the following by default:

order allow,deny
allow from all

IPs will be dynamically appended:

Order Deny,Allow
Allow from all
Deny from

The way I understand this is that it is by default allow all with the optional list of deny rules. If I'm not mistaken Order Deny,Allow will look at the Deny list first, is this correct?

And does the Allow from all rule need to be at the end?


If I'm not mistaken I need to do this based on jeffatrackaid's answer:

Order Allow,Deny
Allow from all
Deny from


For the sake of completeness, this is probably more appropriate for my requirements:

Order Deny,Allow
Deny from

This rule allows everyone into your site.

Order Deny,Allow
Allow from all
Deny from

The Order directive determines the order in which your rules are processed. With Order deny,allow the deny list will be processed first then the allow list.

With Apache, all rules are processed with the last one matching being the effective rule.

So in this case, your last rule would be allow from all.

This means that would initially be denied but then allowed since the allow rules are processed last.

This would produce the same result

Order Deny,Allow
Allow from all
Deny from
Allow from

Think of it this way.

  • The allow/deny rules are simply separate lists of IPs to be allowed/denied.
  • The order directive determines the order in which these lists are processed.
  • Apache evaluates all rules and acts on the result of the last matching rule.

The major confusion is that this is very different from how firewalls work where rule order and first match is often what determines access.

See: http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order

  • Thnaks for the detailed explanation. I was under the impression that 'deny, allow' will always apply the deny rule, even on subsequent attempts. Any recommendations on how I can achieve this? – kaizenCoder Jun 9 '14 at 22:15
  • Your updated code allow,deny should work. The allow list is processed first followed by the deny list. So if an IP is listed in the deny list it will be blocked since it will be last matched. Just one note, if you have too many deny rules you may see performance issues. All rules are processed on every request. "Too many" depends on your hardware and server loads but something to keep in mind with any tool that auto-adds rules to .htaccess. – jeffatrackaid Jun 10 '14 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.