I added this code to my .htaccess file

#deny all russian IP's
Order allow,deny
deny from .ru
Allow from all

My questions:

  1. Can it go anywhere in the file? I added it to the end.
  2. Do I put the code in the root .htaccess file? I have lots of .htaccess files; they are all over the place with a Prestashop site.

enter image description here

  • 1
    Just out of curiosity, why do you want that? – bipll Feb 19 '18 at 23:59
  • I have a russian bot sending hundreds of messages on my contact page - its crashing my site and making it unusable for all my customers. I installed a SlideCaptcha but it appears to be able to go round it. – Chezzers Feb 20 '18 at 5:07
  • So you do realize that you're blocking the whole large top-level domain in order to block something that is very likely to go on spamming you from a different segment? :-O – bipll Feb 20 '18 at 7:10
  • no but i do now - thanks – Chezzers Feb 20 '18 at 9:31

Can it go anywhere in the file?

Yes and no. In general, if you have added it to the end of the file, it should be fine. But the reason I say “yes and no” is without knowing the rest of the contents of the .htaccess file it’s impossible to give a definite answer. For all I know you have other allow/deny directives that might interfere with this one.

Do I put the code in the root .htaccess file?

Yes! It should go in the root. I am not completely clear on the logic of the other .htaccess files in a Prestashop site, but I cannot imaging those non-root .htaccess files will interfere. In general an .htaccess file at the root will cover all other paths beneath it.

That said, this kind of “hunt and peck” method does not effectively work since you need to constantly update it; it’s going to give you more headaches than it is worth.

Instead, if you are a system administrator and know how to use IPtables and IPSec then those tools are better alternatives to blocking whole IP ranges. They are faster, more robust and more flexible than just hacking away at .htaccess files endlessly. This thread on Server Fault explains the basics of doing country-bass IP address blocking using IPsec and IPtables and is worth a look.

But, again, since these are really deeper level OS tools for IP blocking, if you are not comfortable using tools like this, you might be better off just using .htaccess for the time being.

  • 1
    Just worth remembering - using iptables and such would look like your site isn't there. In theory, while his approach feels totally wrong, you might get an actual error message if his web server goes "eh, this russian ip. GO AWAY!" – Journeyman Geek Feb 20 '18 at 2:14
  • @JourneymanGeek True, one could send a specific message to a Russian IP address using .htaccess but it’s not a practice most people deal with. Just dropping the IP connection and moving on with life makes the most sense. – JakeGould Feb 20 '18 at 2:30

I think... you don't quite get the relationship between IP addresses and domain names. Firstly typically, unless you explicitly set it up that way, one or more domains map to an ip address, not the other way around, and when you do set up rdns - your typical web server dosen't care about it. In short .ru dosen't mean anything in this context to your webserver.

You might ask... "But what about geoblocking?" - well, you'd basically find a list of ip addresses - aka a geoip database, and use some tool to do the blocking for you.

A .htaccess file is really an override for a specific directory. Its worth remembering apache actually dosen't recommend its use. If you want to block something, it should presumably set up in the main config file

Mucking around a bit - you can apparently get htaccess files from the internet with a list of IP ranges - the one I generated here's about 3mb for Russia - and I'm unsure of the effects of throwing about large IP address ranges to block on your server

  • The Apache warning about using .htaccess is truthy. Here it is “You should avoid using .htaccess files completely if you have access to httpd main server config file. Using .htaccess files slows down your Apache http server.” The rationale being that Apache would need to check each directory for an .htaccess file and that could theoretically slow things down. But in practice on modern servers, this speed loss is negligible at best. The vast majority of well known web apps use .htaccess such as WordPress, Drupal and such. So no big whoop in 2018. – JakeGould Feb 20 '18 at 2:33

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.