Block Visitors by Referrer

The Apache Web Server enables us to deny access to visitors based on where they come from.

If you look at your logs and see people coming from a site you don't like, or you're being flooded, or hacked, or someone is "hotlinking" your files or images, you can block them quite easy.

This is done via what's called "mod_rewrite", and it must be turned on in your server. Only your administrator can do this. If it doesn't work, ask them to turn it on. Its a security hazzard and used incorrectly it may use many more system resources, so use it responsibly.

To block a single referrer, add the following to your .htaccess:

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} otherdomain\.com [NC]
RewriteRule .* - [F]

This means that we are blocking access from the URL "otherdomain.com". The "[NC]" part means "Not Case sensitive". Which also blocks, just in case, "'OtherDomain.com", "otherdomain.com", "OTHERDOMAIN.COM" or any other combination.

If you want to block multiple referrers, modify your .htaccess file with something like this:

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} otherdomain\.com [NC,OR]
RewriteCond %{HTTP_REFERER} anotherdomain\.com
RewriteRule .* - [F]

This means same as above but now blocks "otherdomain.com" and "anotherdomain.com". please note the backslash before the .com. This is important. The only difference between blocking single referrers and multiple referrers is the modified [NC,OR] flag in the multiple referrers example, this should be added to every domain blocked except the last one.

If you see the second line, it says "# Options +FollowSymlinks". The "#" means the line is commented, so it doesnt do anything, but you should erase the "#" if your server suddenly gives a "500 Internal Server Error". And contact your system administrator for advice with this.

When you block a referrer, the "403 Forbidden" page will be shown. You can change this error page, I teach you how to do it in the "Change Error Documents".