Blocking POST method

[TorontoBoy]

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^http://.*example\.com [NC]
RewriteRule .* - [F,L]
</IfModule>

I do block posts unless POST from my site.


- - -

[edited by: keyplyr at 1:41 am (utc) on Jul 6, 2018]
[edit reason] clean-up [/edit]

[lucy24]

Psst! You don't need the IfModule envelope in this situation. It is sometimes necessary to include it if it's part of CMS boilerplate, but in your own config / htaccess file the envelope is superfluous. Either you've got mod_rewrite or you haven't.

The [L] flag will do no harm, but it isn't needed. All 400-class responses ([F,] [G], [R=404] and so on) carry an implied [L].

If you really want to save the picoseconds, replace .* with . alone. The server doesn't need to read the whole URL; it just needs to verify that there is one. (Kinda pointless here, since if there had been no request, mod_rewrite wouldn't be running in the first place, but there you have it. The syntax of the module requires that there be something at this point in the pattern.)

[not2easy]

Just a note for those using WordPress - your WP crons use "POST" and don't use a referrer.

The UA is the currently installed version number of WP + your domain name in the UA. It might be easier to allow for your domain IP than continually needing to update the version number, especially with automated updates. Just mention this so some WP person doesn't drop in and copy/paste a cron block.