Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of me.

He serves all my content with his own domains, Currently I denying stealer with cloudflare Under Attack Mode

I try Block IP with .htaccess & wordpress firewall plugins but these not stop him. (stealer domain viewers also show in my analytic)

Is there a way to make it so my server will only respond to requests from my domain?

I'm hosting Wordpress with LAMP stack on Ubuntu 16.04 (OVH VPS).

2 Answers 2


Your Apache is improperly configured. Apache should only respond to properly configured domains. Somehow, your Apache is configured to respond to any domain, which is your problem.

Check your config for something like this in the VirtualHost block

ServerAlias *

That could be your problem, as Apache will now serve up any domain for that virtual host. Instead, it should look something like

<VirtualHost *:443>
    ServerName www.yourdomain.com
    ServerAlias yourdomain.com

Another solution is to make their domain have its own config that returns a 404 (make sure this config loads first)

<VirtualHost *:443>
    ServerName   hijackdomain.com
    ServerAlias  www.hijackdomain.com
    Redirect 404 /
    ErrorDocument 404 "Page Not Found"
  • The first virtual host in Apache always matches all host names regardless of whether it contains the wildcard server alias. I always recommend creating a first default virtual host that always returns 404 errors. Apr 23, 2019 at 10:50

Hope this will be helpful for others. This is how I stop stealer with javascript

var x = location.hostname;
if ( x != 'www.example.com'){

Then use this javascriptobfuscator to encrypt the script and put on top of header file.

Because of encryption domain name not replaceable (In my case stealer use nginx to change domain name)

If anyone need server side solution

if ($_SERVER['SERVER_NAME'] != "www.example.com"){
    if ($_SERVER['SERVER_NAME'] != "example.com"){
        echo "<script>window.location.replace(\"https://www.example.com/\")</script>";
  • Why use JavaScript when you could issue a server side redirect? Search engines may not honor that JavaScript redirect. Apr 23, 2019 at 10:51
  • In my case every request made with my domain then stealer use my source code for his domains, so server side cannot detect his domain. Even without encryption JavaScript not work for me
    – F.A
    Apr 23, 2019 at 10:57
  • If it is served by your server it can be detected by your server. Your server side version is the one that should be issuing the resurrect. I can see the case for a js only solution if they are using a reverse proxy to mirror your site. Apr 23, 2019 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.