As for the forbid directory. I'm not sure I'm understanding what you mean.
And
I'm not understanding what
you mean. If you're excluding the entire site, why are you constraining the rule to just one directory? Does the directory even exist?
I suspect you're confused about the structure of a RewriteRule, and possibly also about how Regular Expressions work. There are four pieces, separated by blank space (the space acts as punctuation):
RewriteRule .? - [F]
is structurally the same as
RewriteRule ^blahblah http://example.com/otherblahblah.html [R=301,L]
#1 "RewriteRule": this part says what will be happening in the rest of the line. The other possible content is "RewriteCond", leading to a different set of pieces.
#2 "pattern" = if a request matches this pattern, evaluate the Conditions, if any; if all conditions are met, then apply the rule. The form .? means "all requests of all kinds, including requests for the root".
#3 "target" = take this action if the pattern fits
and any conditions are met. A - means no changes.
#4 optional "flags" = extra information that mod_rewrite uses.
If you're messing about with mod_rewrite, you'll need to learn some basics about Regular Expressions. They're a powerful tool, but you can seriously hurt yourself with a carelessly applied regex.
Edit: Going back to the first post
1st. I attack the user agent
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^facebookexternalhit.*$ [OR]
2nd I ban the user agent
RewriteRule ^forbid/(.*)$ / [R=403,L]
Yup, some misunderstandings there. A RewriteCond isn't a separate animal. It belongs to the immediately following RewriteRule. Each rule can (optionally) have one or more conditions. The whole package-- rule with preceding conditions, if any-- is called a ruleset.
Here you have a rule:
"if the request is such-and-such, deny the request"
with preceding condition:
"take this action if the user-agent is facebookexternalhit".
Unlike most unwanted visitors, facebook rules have to cover all requests; it isn't enough to write a rule for requests in .html. Especially not if they already know your image files exist. You might, however, consider an alternative route:
RewriteRule \.(jpg|png|gif) /pictures/onedot.gif [L]
where "onedot.gif" is a single-pixel transparent gif that you've made for this purpose. (It can also be used for other things; I call it an administrative gif.) This is less work for the server than sending out the full 403 response. And it's just as effective, because they never get hold of a real picture that people can then click on or hotlink to.
Final caution: sometimes they'll pull a different user-agent. Lately I've found a few "visionutils/0.2"-- so far, always from the 173.252. range-- mixed in with the two versions of facebookexternalhit.
