best 403?

[roshaoar]

Just wondering if anyone has any experience to share about the best 403 response to serve - in particular, one that actually makes banned parties say to themselves "uh, ok, let's take that url off the list".

I've run a gamut from all singing dancing affairs with lots of links to pages on the site and search (for the single human visitor per year) to the 0 byte response (I ain't giving them any info, dammit). I'm aware of trendy black holes but didn't reduce anything for me.

So is there anything that people have tried which not only 403s the badGuys but also actually gets them off your back (as opposed to just plugging the hole)?

Thanks!

[lucy24]

in particular, one that actually makes banned parties say to themselves "uh, ok, let's take that url off the list"

Where's the "ROFLMFAO" emoticon when you need one?

It's an open question whether blocked robots even read the content of a 403 page or just make a note of the response. Some individual offenders do seem to go away faster if you serve a different response, such as 404 (yes, it can be done manually for pages that exist perfectly well for desirable humans) or a contemplate-your-navel redirect such as 127.0.0.1 or requester's-originating-IP. But the experimentation itself may take more time than the unwanted visitor is worth.

The one category of visitor you can be absolutely certain will look at your 403 page is the well-intentioned human-- for example, someone requesting a /directory/subdir/ file from an URLpath that happens not to have a page at that level.

Only you can decide whether you prefer to help some people who don't need help, or deny help to some who do need it. Ahem.

[roshaoar]

Ouch, harsh :) But for what it's worth, I'm finding that a 0 byte 400 response makes fewer bots come back than the pretty 403 response. But hey ho, glad to amuse

[lammert]

I have a domain wastebasket.example.com which DNS query returns 127.0.0.1. It is used as 301 redirect for the worst offenders.

I have found that directly redirecting to 127.0.0.1 is not so effective as some bots are capable to identify that as a bogus IP address.