Forum Moderators: phranque
We desperately are in need to stop referrals to our web site from a handful of locations that have pirated our software. Why they need to come to our site first before the steal - I do not know but in any case, we have tried so many htaccess scripts and nothing seems to work. We ether get a internal server error or, when we don't, the bad sites are still flying in. We are getting slammed with 1000+ visits a day.
Here is the code we used that did not stop them.
1. We are on a Apache server at port 80.
2. I will use 'example' in the names just for this post.
RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} example123\.com [NC,OR]
RewriteCond %{HTTP_REFERER} example234.blogspot\.com
RewriteCond %{HTTP_REFERER} example345\.ru
RewriteRule .* - [F]
thank you ever so much for any help!
Sara
[edited by: jdMorgan at 8:19 pm (utc) on April 2, 2009]
[edit reason] example.com [/edit]
What's in your server error log when you get this error?
(Cross-check the timestamp(s) from your server access log.)
Do you have other mod_rewrite code that works?
(If not, test with a simple 301 redirect first, to get mod_rewrite working.)
Here's the most common problem: If you use a custom 403 error document, as defined by an ErrorDocument directive in your .htaccess file, or set up by your "control panel," then that custom error document must be excluded from the 403-generating code above with a negative-match RewriteCond. For example:
RewriteCond %{REQUEST_URI} !^/path/from/web/root/to/your-custom-403-error-page.html
Jim
Sadly, you went completely over my head. LOL!
The script that is currently in place does not toss an internal error but it also does not block.
To be honest, we are willing to pay a programmer to stop this traffic. We are in the audio world and only dabble in your world.
Thank you again,
S
[edited by: Sara_Page at 3:27 pm (utc) on April 2, 2009]
They must NOT appear on the last Condition.
Is this what you mean?
RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} example123\.com [NC,OR]
RewriteCond %{HTTP_REFERER} example234\.com [NC,OR]
RewriteCond %{HTTP_REFERER} example345\.ru
RewriteRule .* - [F]
If so, no error but if I go to one of the bad sites listed in this code, I can go right back to ours. That should not be, right?
[edited by: Sara_Page at 3:46 pm (utc) on April 2, 2009]
[edited by: jdMorgan at 8:20 pm (utc) on April 2, 2009]
[edit reason] example.com [/edit]
Please be aware that we don't normally do that here; This is a discussion forum, not a free repair service. Please review our forum charter.
Again, if you get a server error, your best bet is to look at the server error log. If you don't know where it is, ask your host. This is a critically-important thing to know, and a very-highly-useful resource to access.
What g1smd is saying is that your code is broken and cannot work, because it requires the referrer to be *both* the first OR second referrer *AND* the third one -- you are requiring the referrer to be two different domains at the same time, which is clearly impossible. So the code needs to be fixed:
Options +FollowSymlinks
RewriteEngine on
#
RewriteCond %{REQUEST_URI} !^/path-to-custom-403-document\.html
RewriteCond %{HTTP_REFERER} example123\.com [NC,[b]OR[/b]]
RewriteCond %{HTTP_REFERER} example234\.blogpot\.com [NC,[b]OR[/b]]
RewriteCond %{HTTP_REFERER} example345\.ru [NC]
RewriteRule .* - [F]
[edited by: jdMorgan at 8:17 pm (utc) on April 2, 2009]
Again sorry and thank you all for your help and knowledge!
This stuff is very technical, and you are well advised to spend some time at apache.org, reading the manual. :)
Most of it is incomprehensible at first, but as you spend more time with it, you'll gradually understand more and more.
Test the code and see. Unfortunately, due to the many different ways in which servers can be configured, there is no "one right way" that is guaranteed to work in all cases. That said, this code is trivial, and it should be easy to get it working.
Completely flush your browser cache before testing any new code to avoid stale cached results confusing your test results.
Jim
Grr! Ok so I am thinking of that song, "Stupid girl" LOL
PS. I did clear cache via firefox. I'll try with IE too.
EDIT: Still the same.
[edited by: Sara_Page at 4:08 pm (utc) on April 2, 2009]
That's why using referrer data is unreliable at best.
Check your server access logs to see if the referrer data is there or not.
The order of operations is important.
Jim
There is a file on our saver in the logs folder that says our site name.com. It's 3 MB file that wants to open in DOS.
"using referrer data is unreliable at best."
is there another way to block them?
I was just letting you know that it isn't fool-proof.
I went to the bad site and then clicked on the link they provide and I was not allowed to our site!
OMG! THANK YOU SOOOOOOOO MUCH!
Last question: How do I add more sites to jims code?
Add one for each site.
Make sure that you write the dot in the name as
\.
example456.com.br/
It has .com and .br
Im not sure how to do the [NC,OR] line.
Thank you
[edited by: jdMorgan at 8:20 pm (utc) on April 2, 2009]
[edit reason] example.com [/edit]
It says, "block referers that match this, or that, or this, or that. Note how the last 'that' word in this sentence does not have an 'or' after it... same thing in the code.
Simply add more RewriteConds, and escape all literal periods by preceding them with a "\". I was not utterly consistent in doing that in my initial posting, and need to go correct that.
RewriteCond %{HTTP_REFERER} example456\.com\.br [NC,OR]
Jim
[edited by: jdMorgan at 8:21 pm (utc) on April 2, 2009]
If I may, I have one last question. Is there any way to ban a site that is attacking ours but they are coming in by typing the url. It's no longer a linked url. We see the full url from where they are coming from via our web stats but cannot htacess ban the user because they are not clicking on a posted link back to us.
Best and TGIF!
[edited by: Sara_Page at 12:51 pm (utc) on April 3, 2009]
Add another RewriteCond at the top of your list of ORed referrers:
RewriteCond %{REMOTE_ADDR} ^192\.168\.0\.10$ [OR]
Remember, all the things you want to block should be ORed, except the final one. [NC] is not used in this RewriteCond because we are looking at numbers, and there's no such thing as an uppercase or lowercase number.
Jim
[edited by: jdMorgan at 1:30 pm (utc) on April 3, 2009]
But wouldn't I need the IP address of all the people coming form the bad site? Or - are you saying just use the IP of the bad site and that stops all visitors from? I already traced the sites IP and banned that but via IP deny of our control panel, we are still getting hit with all their traffic.
[edited by: Sara_Page at 1:36 pm (utc) on April 3, 2009]
NS.'''''.NET xx ip xx
NS2.'''''.NET xx ip xx
NS3.'''''.NET xx ip xx
Geo Information
IP Address xx ip xx
We see the full url from where they are coming from via our web stats but cannot htacess ban the user because they are not clicking on a posted link back to us.
Sorry, I interpreted this to mean that you saw the unwelcome visitors' IP addresses, but no referring URL.
If you *are* seeing a Referer header in the logs, then I don't know what you mean when you say you think you can't block them using a referrer-based block. There's no magic here: As long as the logged referrer matches one of your RewriteCond patterns, and as long as this mod_rewrite rule executes before any other mechanism transfers control to a content-handler, the request will be denied. However, if the unwelcome visitor's client (e.g. his browser or application program) does not send a referrer header, or if that header gets blocked or dropped by 'security software', a firewall, or caching proxy at his ISP, then there's nothing you can do other than to block that specific visitor's IP address; As pointed out at the start, the HTTP Referer header is not always present, and therefore, referrer-based access control will never be a 100%-reliable method.
I also suggest you look at your server access and error logs instead of relying on 'stats'. The scripts that analyze your raw server logs to produce 'stats' make pretty reports, but they often omit data which is important when analyzing server abuse.
Jim
I guess my question is - even if the site is blocked via htaccess as you have shown me, can't they just type in our site and go? Then again, why do we see where they are coming from? It's always the same url. I'd post it here if I was allowed.
[edited by: Sara_Page at 6:34 pm (utc) on April 3, 2009]
