How to block users from accessing your site based on their IP address

How to block users from accessing your site based on their IP address

Blocking users by IP address is pretty simple with .htaccess.
So here it is the example:

Order allow, deny
Deny from 192.168.0.10
Deny from 212.155.
Deny from 1.2.3.4  5.6.7.8 127.0.0.1
Allow from all

Let’s take a look at the code line by line:
The first line “Order allow, deny” tells the web server the “Order” in which the Allow and Deny directive will be evaluated. It simply says: Give access to all hosts that are not present in the Deny from list and are present in the Allow from list. With allow, deny order Allow list is looked up first and then the web server checks the deny from list. So as we have allow from all – all access is allowed. Then the allowed access is filtered based on the Deny lists. With allow,deny access is disabled by default.

If we change the order to “deny, allow” then all access is enabled by default and only users in the deny lists are blocked. However as the deny is being processed first allow directives will override any maching settings set in deny directives.

The default Apache order is deny,allow. So you can skip the first line in your .htaccess file if you do not need to change the order in which the Deny and Allow rules are being evaluated by the web server.

So to keep the .htaccess simple you can just use:

Deny from 192.168.0.10
Deny from 212.155.

Basically you can use such rules in your .htaccess file to block a particular user, or a network from accessing your site.
You can put several IP address in a Deny or Allow rule. For example:

Deny from 1.2.3.4   5.6.7.9

The IP addresses must be separated by a space or tab.

You can put entire networks as

Deny from 212.155.

This will block all users which IP addresses start with 212.155

Or to block all access to your site:

Deny from all

And then add another line to enable access only for yourself:

Allow from 1.2.3.4

Where “1.2.3.4” should be replaced with your computer IP address.

Force SSL/https using .htaccess and mod_rewrite

Sometimes you may need to make sure that the user is browsing your site over securte connection. An easy to way to always redirect the user to secure connection (https://) can be accomplished with a .htaccess file containing the following lines:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

Please, note that the .htaccess should be located in the web site main folder.

In case you wish to force HTTPS for a particular folder you can use:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} somefolder
RewriteRule ^(.*)$ https://www.domain.com/somefolder/$1 [R,L]

htacces: Invalid command 'SecFilterEngine' + 500 Internal server error

We are getting 500 Internal Server Error on the site.

All the file permissions and ownerships are correct.

-----------------

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@the-landscape-design-site.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.

----------------------------------------------------

As I checked the apache error logs, it is showing-

----------------------------------------------------------------------------------------------

[Wed Mar 17 02:25:40 2010] [alert] [client xx.xx.x.xxx] /home/USER/public_html/.htaccess: Invalid command 'SecFilterEngine', perhaps mis-spelled or defined by a module not included in the server configuration, referer: http://www.websitename.com/

---------------------------------------------------------------------------------------------

Fix:

vi /home/USER/public_html/.htaccess

and search for the line containing words "SecFilterEngine" and "SecFilterScanPOST" and make comment for these lines and you can add following 4 lines(without number) proper code to disable mod security for this particular site.

--------------------------------

SecFilterEngine Off

SecFilterScanPOST Off

--------------------------------

save your .htaccess and restart apache on server. Your site should work now.

**********************************************

You can also disable mod security for a domain through virtual entry in httpd.conf.

First you should login to your server via SSH as the ‘root’ user.

You should then use nano or your favorite text editor (ie. pico, vi etc…)

to open the /etc/httpd/conf/httpd.conf (sometimes /usr/local/apache/conf/httpd.conf or /etc/apache2/httpd.conf) file.

Notice: You may have to edit a different file such as

/etc/httpd.conf/conf.d/vhosts.conf if your server is setup to use a separate vhost configuration file.

You should then locate the vhost for the domain in question and paste the following code into the vhost:

--------------------------

SecFilterEngine Off

SecFilterScanPOST Off

-------------------------

Now you just have to save, exit and restart apache. Run service httpd restart or /etc/init.d/httpd restart or whatever script you have to restart Apache.

You can manage most of the main mod_security settings from a .htaccess file, so you can control it down to a per-domain, per-directory and/or per-file basis, switching off individuals rules, added new ones and just turning it off.

*********************