1

Getting several amounts of bad requests from a particular URL such as site.foo and I would like to redirect all these requests to a dedicated page. The .htaccess code I've researched and implementing is:

RewriteCond %{HTTP_REFERER} http://site.foobar 
RewriteRule ^ https://bar.com/notallowed.html? [R=301,L]

However, researching HTTP Status codes I'm still unsure with the 301: 

301 Moved Permanently
This and all future requests should be directed to the given URI.

or the 403:

403 Forbidden
The request was valid, but the server is refusing action. The user might not have the necessary permissions for a resource, or may need an account of some sort.

So which is the proper usage case and am I using the proper rewrite rule? Is there a proper HTTP status code to use to stop bad referrers?

In my research I ran across:

In case the next person that runs across this is curious.

| improve this question | |
  • Is this referral spam? Or is this other site genuinely linking to you? – MrWhite Jan 26 '18 at 16:15
  • This is a spam site and I edited the question and added the spam tag. – DᴀʀᴛʜVᴀᴅᴇʀ Jan 26 '18 at 16:15
  • 1
    Personally I would use a 403. A 301 does not send the right message to me. Plus if Google follows the links, it should also get the message. Cheers!! – closetnoc Jan 26 '18 at 17:23
  • Personally I'd use 301 redirect to this or even this but 403 is more PC correct or even better to block them before they even get to the HTTPd using Fail2ban or similar. – Simon Hayter♦ Jan 26 '18 at 18:14
  • 1
    I concur with returning a 403 as well. Reserve your 301 redirects for internally migrated url paths (change of addresses). – Anson W Han Jan 28 '18 at 4:40
1

I would use the "403 Forbidden" status. You just need to change your rewrite rule

RewriteCond %{HTTP_REFERER} http://site.foobar 
RewriteRule ^ - [F]

Reference: https://httpd.apache.org/docs/trunk/rewrite/flags.html#flag_f

| improve this answer | |
  • Rusty on my htaccess. Do you mind explaining how that is different then my above regarding the rewrite rule? I think I have my condition correct. Do you get dinged if redirecting to Google? – DᴀʀᴛʜVᴀᴅᴇʀ Jan 30 '18 at 18:52
  • 1
    You wouldn't get dinged, but the 403 status is the correct thing to use. I just changed your rewrite rule to use the [F] flag which makes the request forbidden. I linked to the documentation for that. – Stephen Ostermiller♦ Jan 30 '18 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.