Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Make your site anti-bot?

I have a custom web form on my PHP-based site.

Recently it is getting a regular stream of comment-spam postings from a few specific IP addresses.

Question: What is a good way to block a small set of blacklisted IP addresses from accessing my site?

I was thinking it should be possible using .htaccess to respond with status code 403 (Forbidden) for all HTTP requests from the blacklisted IP addresses, ... but I am not sure exactly how to do that.

If anyone knows the .htaccess syntax needed to accomplish this, ... please let me know.

thanks in advance,

share|improve this question

migrated from serverfault.com Feb 28 '11 at 9:58

This question came from our site for system and network administrators.

marked as duplicate by John Conde Feb 28 '11 at 13:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I use Akismet to block comment spam in my Wordpress log. (Almost all comments are spam, but I still get an appreciate proper comments.) This service can be used by other comment streams. Plugins are available for various applications. The code is PHP and should be looking at.

share|improve this answer
original poster wasnt asking about WP although akisment is a very useful tool – anthonysomerset Feb 28 '11 at 8:28
No need to downrate, as Akismet provides an API. There are two stand-alone PHP implementations listed on akismet.com/development – weeheavy Feb 28 '11 at 8:42

Another possible trick is to create a form element that you hide with css, then validate your form, if that form element has content in it you can reject the form as a normal user would not have been able to fill it in therefore it must most likely be spam.

In htaccess you would have to fully block those IP's to my knowledge, but to block an IP from browsing your site, add the following to your HTAccess file

order allow,deny
deny from
allow from all`

where is the IP you want to block, to block extra IP's just duplicate the deny line and edit the IP to match

share|improve this answer
I find the hidden (with CSS) element very effective. However, many of these browser extensions that auto populate form fields can auto populate your hidden field as well and so flagging the submission as possible spam! You can try using an obscure field name to prevent the browser from auto populating this field, but then robots might be less likely to populate it as well?! – w3dk Feb 28 '11 at 10:06

The best way I have found to get rid of comment spam is using a CAPTCHA system. There are plugins for vaious systems including PHP that make implementing them very easy. This is one of the techniques used by this site.

With regard to blocking IP addresses the best form of defence is a good firewall. Simply add the offending IPs to the firewall's blacklist. That said blocking IPs won't stop the issue as many spammers are using botnets these days that use different IP addresses for each attack.

share|improve this answer