Modifying .htaccess to use a whitelist

Attempting to combine whitelist with blacklist in .htaccess file

[sgibb]

This is my first post. My .htaccess file was doing quite well until recently when I got hit by a bunch of user agents with strings of random letters.

I am now trying to modify my .htaccess file to include a whitelist and yet deny certain user agents and referers. For instance, to allow all Mozilla user agents in I use the following:

<Limit GET POST PUT HEAD>
order deny,allow
deny from all
allow from env=good_pass
BrowserMatchNoCase ^Mozilla good_pass
....
</Limit>

Some that get in either have Referers I would like to deny access to or are disobeying the robots.txt. Prior to trying to implement the whitelist I used RewriteCond %{HTTP_USER_AGENT} ^abc and RewriteCond %{HTTP_REFERER} successfully but the whitelist seems to take precedence.

I'm guessing I have to package the two together somehow - saying "allow Mozilla except when ..." but I'm not quite sure how. I would appreciate some help in this.

[jdMorgan]

The first step is to convert all of your directives to either mod_rewrite or mod_access. Otherwise, you won't have direct control over which directives take precedence. More on that subject here [webmasterworld.com].

Jim