Block Unwanted Visitors To Your Website With .htaccess

Unwanted visitor won’t bring you any good or benefit. Unwanted visitor may harm your website or server and wasting your money indirectly. And since they don’t bring you any benefit and may cause harm to your server that will effect your loyal visitors/readers, so we need to block them.

So who is the unwanted visitors? Here some of them:

1. Scrape Bot
2. Vulnerable finder bot
3. Spam bot
4. Unknown spider/crawling bot
5. DDOS attack

Those bot doesn’t do anything good for you, they stealing content, injecting malicious code, spam your comment box, and crawling your website for nothing. They just wasting your bandwidth, increase server load, slow down your server which may cause less experience for your loyal visitors. This should be stop.

You should stop those kind of visitors, you don’t need them. To block them you can do it with .htaccess.

To block by ip addresses:

<limit GET,POST>
order allow,deny
deny from xxx.xxx.xxx.xxx
allow from all
</limit>

To block by specific ISP:

<limit GET,POST>
order allow,deny
deny from some-evil-isp.com
allow from all
</limit>

To block by spider name:

<limit GET,POST>
order allow,deny
SetEnvIfNoCase User-Agent "libwww-perl" bad_bot=1
deny from env=bad_bot
allow from all
</limit>

To block by User agent:

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^First_string_here [OR]
RewriteCond %{HTTP_USER_AGENT} ^Another_string_here [OR]
RewriteCond %{HTTP_USER_AGENT} ^Last_string_here
RewriteRule ^(.*)$ http://your.domain.com/custom_error_page.html

To see the visitor’s ip address, user agents, or spider name you can see in your access_log. Or in WordPress you can install Statpress plugin to see your visitors detail and statistic. If you see something unusual just block them. You don’t need such visitors.