Someone has setup a CDN server which is directing traffic to my server and setting the HOST header to match one of my real domains. Because of this, Apache uses the virtual host for my real domain name instead of the host name for the CDN domain.

For example, the URL is:


It appears this CDN is a proxy that is overriding the HOST header. Apache sees the host as www.mydomain.com instead of cdn.example.com.

I'd like to block this traffic, but I can't block via host or IP (because it changes). There is a host header:



edit: don't have mod_security installed

  • possible duplicate of mod_security block requests by http-host header
    – Hyppy
    Jun 2, 2015 at 16:36
  • mod_security is your friend. Check the duplicate post link above.
    – Hyppy
    Jun 2, 2015 at 16:36
  • 1
    mod_security can certainly do this, but if he's not already using it, it will be easier to use mod_rewrite, as in alphamikevictor's answer. Jun 3, 2015 at 7:07

1 Answer 1


You can use mod_rewrite to accomplish this task:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Host} cdn.example.com
RewriteRule .* - [F]

As you can see, if you test it with curl denies the access:

[root@RPX conf]# curl -i -H "X-Forwarded-Host: cdn.example.com" http://localhost:80/algo/
HTTP/1.1 403 Forbidden
Date: Tue, 02 Jun 2015 16:49:37 GMT
Server: Apache
Content-Length: 207
Content-Type: text/html; charset=iso-8859-1

<title>403 Forbidden</title>
<p>You don't have permission to access /algo/
on this server.</p>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .