0

I'm using CloudFlare in a shared environment and I'm trying to help block non-CloudFlare users who circumvent to my origin IP. Loading up the web page I see the header server: "cloudflare". So I tried the following htaccess code and I get a 403 right away.

RewriteCond %{HTTP:server-header} !^cloudflare$ [NC]
RewriteRule ^ - [F]

RewriteCond %{HTTP:x-server-header} !^cloudflare$ [NC]
RewriteRule ^ - [F]

I've also tried variances of the code and nothing works.

1
  • 1
    What exactly is the name of the header you are seeing? And where are you seeing this? In the browser response?
    – MrWhite
    Sep 18, 2019 at 21:29

2 Answers 2

2

Blocking requests based on the existence of this specific header is a bad idea. The reason is that anyone can spoof that header if they wanted. This could be filed under security by obscurity and it is not even that obscure.

A better approach would be to only allow requests made from CloudFlare IP addresses. A list of CloudFlare IP addresses can be found here: https://www.cloudflare.com/ips/

An example for IPv4 only would be:

order deny,allow
deny from all
allow from 173.245.48.0/20
allow from 103.21.244.0/22
allow from 103.22.200.0/22
allow from 103.31.4.0/22
allow from 141.101.64.0/18
allow from 108.162.192.0/18
allow from 190.93.240.0/20
allow from 188.114.96.0/20
allow from 197.234.240.0/22
allow from 198.41.128.0/17
allow from 162.158.0.0/15
allow from 104.16.0.0/12
allow from 172.64.0.0/13
allow from 131.0.72.0/22 
1

I just found two solutions.

One is to use:

RewriteEngine On
RewriteCond %{HTTP:CF-IPCountry} ^$
RewriteRule ^ - [F,L]

The other is here:
https://community.cloudflare.com/t/stop-cloudflare-bypassing-on-shared-hosting/91203

1
  • curl --header 'Host: CF-IPCountry: US' --resolve 'example.com:80:direct-server-ip' example.com Replace the example.com with your domain and the direct-server-ip to your external server IP and eventually the port 80 to 443 for HTTPS. This request would bypass that .htaccess rule.
    – eKKiM
    Sep 19, 2019 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .