ns:
There are a couple of approaches you can use. afree2 mentioned RewriteCond -- this wasn't a recipe but a hint at where to go next. I'll fill in some more details but am typing fast and don't have time to verify this. That said if you take either of these approaches and keep the link to the docs in hand, you should be up and running in no time.
If you run into issues it'll likely be simple configuration changes you need to track down in either httpd.conf or .htaccess (choose one or the other but not both... httpd.conf preferred) depending on which way you go, but either of these approaches will work.
Note: if your site doesn't already use .htaccess files, *and* you have access to httpd.conf via the command line or a control panel, then don't add .htaccess files to the mix. Wherever possible I disable .htaccess for performance reasons and do it once in httpd.conf where these sorts of rules really belong.
If you don't need .htaccess for any other purpose, and can implement your solution in httpd.conf (presumes you have access/authority to do so) then disable .htaccess in httpd.conf within your virtual host definition as so:
Code:
<Directory /path/to/my/docroot>
AllowOverride None
</Directory>
Moving right along now...
Approach 1: mod_rewrite
Required for either .htaccess or http.conf configuration styles: You need to enable mod_rewrite
if using virtual hosts follow this.
In httpd.conf within your virtual host definition, or in the / .htaccess file:
Code:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^wget [nocase]
RewriteRule ^.* - [forbidden, last]
See also:
http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html
http://httpd.apache.org/docs/2.2/rew...ite_flags.html
Approach 2: Access
Another approach also uses what you already have - Apache - through the fairly simple Allow, Deny access mechanism. We'll use an environment variable to trigger a Deny action.
Step 1: First we are going to set an environment variable for user agents we don't like. This line goes in httpd.conf in the virtual host definition, or in .htaccess in your web site's root directory:
Code:
SetEnvIfNoCase User-Agent "^wget" attackers
If you later discover other user agents you wish to block can just add additional lines.
Step 2: Block requests based on the environment variable "attackers" that we've set up:
IF in http.conf:
Code:
<Directory "/home/yoursite/public_html/">
Order Allow,Deny
Allow from all
Deny from env=attackers
</Directory>
IF in .htaccess (be sure you don't have any .htaccess in subdirectories of the site which overturns this "policy"):
Code:
# .htaccess:
Order Allow,Deny
Allow from all
Deny from env=attackers
Reference:
http://httpd.apache.org/docs/2.2/mod/mod_setenvif.html
HTH.
Linear Mode
