0

I'm using CloudFlare in a shared environment and I'm trying to help block non-CloudFlare users who circumvent to my origin IP. Loading up the web page I see the header server: "cloudflare". So I tried the following htaccess code and I get a 403 right away.

RewriteCond %{HTTP:server-header} !^cloudflare$ [NC]
RewriteRule ^ - [F]

RewriteCond %{HTTP:x-server-header} !^cloudflare$ [NC]
RewriteRule ^ - [F]

I've also tried variances of the code and nothing works.

  • 1
    What exactly is the name of the header you are seeing? And where are you seeing this? In the browser response? – MrWhite Sep 18 at 21:29
2

Blocking requests based on the existence of this specific header is a bad idea. The reason is that anyone can spoof that header if they wanted. This could be filed under security by obscurity and it is not even that obscure.

A better approach would be to only allow requests made from CloudFlare IP addresses. A list of CloudFlare IP addresses can be found here: https://www.cloudflare.com/ips/

An example for IPv4 only would be:

order deny,allow
deny from all
allow from 173.245.48.0/20
allow from 103.21.244.0/22
allow from 103.22.200.0/22
allow from 103.31.4.0/22
allow from 141.101.64.0/18
allow from 108.162.192.0/18
allow from 190.93.240.0/20
allow from 188.114.96.0/20
allow from 197.234.240.0/22
allow from 198.41.128.0/17
allow from 162.158.0.0/15
allow from 104.16.0.0/12
allow from 172.64.0.0/13
allow from 131.0.72.0/22 
1

I just found two solutions.

One is to use:

RewriteEngine On
RewriteCond %{HTTP:CF-IPCountry} ^$
RewriteRule ^ - [F,L]

The other is here:
https://community.cloudflare.com/t/stop-cloudflare-bypassing-on-shared-hosting/91203

  • curl --header 'Host: CF-IPCountry: US' --resolve 'example.com:80:direct-server-ip' example.com Replace the example.com with your domain and the direct-server-ip to your external server IP and eventually the port 80 to 443 for HTTPS. This request would bypass that .htaccess rule. – eKKiM Sep 19 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.