0

These rules work good in my .htaccess:

#https://workinnet.ru/de/wie-man-amazonbot-blockiert/#German language#
SetEnvIfNoCase User-Agent "Amazonbot" blocked_bot
<Limit GET POST HEAD>
    Order Allow,Deny
    Allow from all
    Deny from env=blocked_bot
</Limit>

I tried this for use on Apache 4.4:

SetEnvIfNoCase User-Agent "Amazonbot" blocked_bot
<Limit GET POST HEAD>
    <RequireAll>
        Require all granted
        Require not env blocked_bot
    </RequireAll>
</Limit>

But this does not work. What is wrong?

Improve this question
14
  • In itself, the 2nd config looks OK, however, where exactly have you put this config and what other directives do you have? (You must not mix old (Apache 2.2) style Order, Allow, Deny directives with the newer Apache 2.4 Require directive.)
    – MrWhite
    Nov 12 at 22:50
  • This config is put rather to the end of .htaccess. I have a lot of other directives. The only old directive is the upper shown, all other are "require" instead of "allow/deny". But this old directive works good. But the 2.4. updated version does not work. It is "permeable".
    – josefus
    Nov 13 at 10:21
  • Your <RequireAll> directive works like an AND operator. Both of the next 2 conditions must be true for it to work. You can safely remove the line that says "Require all granted" and it should work
    – Luis Alberto Barandiaran
    Nov 15 at 16:19
  • @LuisAlbertoBarandiaran No you can't. A negated Require directive is never considered "true". Access must be granted somewhere. From the docs, "when the Require directive is negated it can only fail or return a neutral result, and therefore may never independently authorize a request.". So, if you only have a (negated) Require not ... directive then it won't actually do anything.
    – MrWhite
    Nov 15 at 20:04
  • Please update your question with your complete .htaccess file with these directives in place. And what specific Apache version are you on? The most likely cause is that you have a conflict with other authorizing directives outside of this code block. Since the default container is <RequireAny>, any authorizing directives elsewhere in the file that are not "contained" will take priority and authorize access. (Please also clarify that you are not on a LiteSpeed server masquerading as Apache - which could also cause these directives to be ineffective).
    – MrWhite
    Nov 15 at 20:17

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.