so I am running a site on apache. I want to block all visitors from domain *.xyz.com

I tried adding the following in .htaccess file:

<Files *>
order allow,deny
allow from all
deny from .*example\.com.*

this didnt work. Can anyone help?

  • 1
    Tried just putting .example.com? e.g .btcentralplus.com no need to use .* \ or .* Commented Nov 29, 2017 at 23:06

1 Answer 1


Not really. A webserver does not directly know the domain of its users which they may not even have one, in fact.

It does know the referrer, if sent but that only can protect you from a link from a certain domain. They can easily spoofed too, so when used referral discrimination is more of a deterrent than protection. A person that types the URL directly though sends no referrer.

What the server must know is the IP the request is coming which is where it serves the response to. If you want to block people whose machines are within a certain domain, you must block them by IP. Even so, proxies and VPNs can add a relay which effectively changes the IP address of requests.

To block by IP you put in the .htaccess a statement like:

deny from 192.168.*.*


deny from

To do this you have to figure out the IP range for the company or domain you are trying to block. In a few cases that use some kind of gateway, it may be even just one IP address, in others there may be quite a few.

  • 1
    You can block based on hostname too :) Commented Nov 29, 2017 at 23:04
  • To get the hostname of a visitor, not the one of the webserver, you need to do a reverse lookup by IP. It is easy to do in PHP but I have never done that in the .htaccess. There might be a module to do that though.
    – Itai
    Commented Nov 29, 2017 at 23:56
  • Most web servers can be configured to provide the domain name. It is the default with Apache last I looked.
    – closetnoc
    Commented Nov 30, 2017 at 5:21
  • Apache does a reverse query as needed. But this is pretty useless as an authentication method... Commented Nov 30, 2017 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.