Can it go anywhere in the file?
Yes and no. In general, if you have added it to the end of the file, it should be fine. But the reason I say “yes and no” is without knowing the rest of the contents of the
.htaccess file it’s impossible to give a definite answer. For all I know you have other
deny directives that might interfere with this one.
Do I put the code in the root .htaccess file?
Yes! It should go in the root. I am not completely clear on the logic of the other
.htaccess files in a Prestashop site, but I cannot imaging those non-root
.htaccess files will interfere. In general an
.htaccess file at the root will cover all other paths beneath it.
That said, this kind of “hunt and peck” method does not effectively work since you need to constantly update it; it’s going to give you more headaches than it is worth.
Instead, if you are a system administrator and know how to use IPtables and IPSec then those tools are better alternatives to blocking whole IP ranges. They are faster, more robust and more flexible than just hacking away at
.htaccess files endlessly. This thread on Server Fault explains the basics of doing country-bass IP address blocking using IPsec and IPtables and is worth a look.
But, again, since these are really deeper level OS tools for IP blocking, if you are not comfortable using tools like this, you might be better off just using
.htaccess for the time being.