SetEnvIfNoCase vs. RewriteRule

Does it matter which one I use to ban bots?

[MichaelBluejay]

For banning bots by name or IP I understand I can use my choice of SetEnvIfNoCase/Deny or RewriteCond/RewriteRule. I'm having a hard time finding out if there's any practical difference between these, and if there are any pros/cons to using one vs. the other?

[jdMorgan]

Depending on server configuration, you may find that using mod_access (based on mod_setenvif vars) will not log denied accesses to your server *access* log. Access-denied entries will appear only in the server *error* log in this case. On other servers it may make no difference.

Other than that, it's largely a matter of personal style, and also ease of implementation if you're using a script to create the entries... :) There may be a small performance difference as well, but I have no test data upon which to base a recommendation.

Jim

[MichaelBluejay]

Okay, that's good to know, thanks. I checked and my server does log SetEnvIfNoCase rejections, but that's fine with me.

Shall I assume that "deny from (ip)" is the same deal, may or may not get logged, probably little performance difference?

[jdMorgan]

The reason that most access-control scripts use SetEnvIf is these directives can simply be added to the very beginning of the file, so that the script does not have to search for the "insertion point". The "Deny from (EnvVar) directive can then pick up the named variable later in the file.

It's a lot easier to prepend a new record to an existing file than it is to find the right place in the code to insert a new record...

The performance advantage would otherwise go to "Deny from".

Jim