I ran into this snippet in an Apache config file that someone else wrote, but I'm not sure of the purpose. Could anyone explain what this is for?

RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1\.1$
RewriteRule .* - [F]

Those directives reject (403 Forbidden) any request that is not HTTP/1.1. Many bots crawl with a HTTP/1.0 request header - so these will be blocked. All modern browsers will use HTTP/1.1 (at least). However, with HTTP/2.0 already here, these directives are arguably outdated and should not be used.

The THE_REQUEST server variable contains the initial request header of the form:

GET /foo HTTP/1.1

If you want to block HTTP/1.0 only then you could use something like the following instead:

RewriteEngine On
RewriteCond %{THE_REQUEST} HTTP/1\.0$
RewriteRule ^ - [F]

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.