- Is this a proper method for blocking bad bots?
Well, it is one method. (Although you wouldn't block whole user-agent strings using regex alternation; if that is what you are implying by your CondPattern?)
However, "bad bots" often do not disclose themselves using an easily identifiable user-agent. They may use a standard browser user agent, which will obviously render this method useless.
There might also be too many "bad bots" to make this method scalable. It's potentially difficult to maintain unless you are OK with just blocking a few known "baddies".
- Will this have any impact on legitimate users who are withholding their user-agent?
"Legitimate users" shouldn't "withhold their user-agent". It is generally OK to block visitors with an empty user-agent (if that's what you mean by "withholding"). If a "legitimate user" changes their user-agent to mimic a "bad bot" then they can expect to be blocked.
As mentioned above, you can't block "bad bots" that are pretending to be real users (ie. using a standard browser user-agent string), as you will obviously block real users as well.
- Should I be using
.* to finalise the rule or
From a regex point of view,
^ is more efficient in this instance, since you don't need to actually match anything, you just need to be successful for every request.
.* unnecessary traverses the entire URL-path and discards the result. Whereas
^ simply asserts the start-of-string and matches nothing.
.^ doesn't make sense.
[F,L] - You don't need the
L here - it is implied when using the