Prevent request via IP address of server

Question

I'm pretty sure there's a way to prevent access to a website through the server IP address and to force the user to enter the domain name instead.

so that http://156.56.75.87 should trigger a 403 and only access through http://www.example.com should be authorized.

I think there was a modsecurity rule for that but I can't find it anywhere. Does someone know?

Bob Ortiz · Accepted Answer · 2015-04-22 22:17:27Z

3

The rule to activate this block rule in mod_security can be found in: base_rules/modsecurity_crs_21_protocol_anomalies.conf

That will block access to the website when accessed through the server IP-address.

Bob Ortiz

3252 silver badges14 bronze badges

answered Aug 21, 2014 at 19:57

Sam

4644 silver badges15 bronze badges

Add a comment |

closetnoc · Accepted Answer · 2017-05-18 00:37:51Z

2

Here is an .htaccess option for you:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^10\.0\.11\.101$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [R,L]

...to redirect and...

RewriteEngine On
RewriteCond %{HTTP_HOST} ^10\.0\.11\.101$ [NC]
RewriteRule .* - [F,L]

...to block.

Obviously, you will need to change the IP address and domain name to suit your needs. This should redirect any IP based reference to the domain name.

answered Aug 20, 2014 at 21:12

closetnoc

32.8k4 gold badges44 silver badges68 bronze badges

thanks for that but what I want is to reject the request. Here you are rewriting to the domain name.
– Sam
Aug 21, 2014 at 6:16
@Sam Ooopppsss! My Bad!! I updated the answer and left the other option for others down the road.
– closetnoc
Aug 21, 2014 at 14:11
2

ok that would work. My question was related to modsecurity though :) I found the answer somewhere else on SO. I'll post the answer below. Thanks for you help!
– Sam
Aug 21, 2014 at 19:56
@Sam I do highly recommend using mod_security but also recommend where possible using HTTP filters and firewall rules to keep bad actors from the server if possible. Of course this is not always available for hosting. But if a firewall with these options are available, this is a powerful option too. Again, I do recommend mod_security for everyone where possible. One up-vote on the way!
– closetnoc
Aug 21, 2014 at 21:29
You would need to change REMOTE_ADDR to HTTP_HOST in order to catch the situation when the website itself is accessed by the server's IP address. REMOTE_ADDR is the IP address of the client accessing the site.
– MrWhite
May 17, 2017 at 23:39

| Show 1 more comment

2 Answers 2