I need to block RSS pages in htaccess, most importantly these
/rss/catalog/new
/rss/catalog/notifystock
and
/index.phprss/catalog/notifystock
Especially the last one, as you can see it's /index.phprss/ without a slash in between, it works when added in front of domain name, I need to block it.
Could someone please add a rewrite code?
Rule works on 1.7:
RewriteCond %{REQUEST_URI} ^/(index.php/?)?rss/ [NC]
RewriteCond %{REMOTE_ADDR} !^1.1.1.1
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]
The rule below is the rule Magento instructions provide, it doesn't work.
############################################
## make HTTPS env vars available for CGI mode
SSLOptions StdEnvVars
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule ^(index.php/?)?rss/ - [L,R=403]
If anyone see issues with the original rule, please let me know.
RewriteEngine on? You should really consider using the official rule since your rule creates a full Magento instance by redirecting to home for each request that tries hacking your store - no one else will access those urls so you are sacrificing performance and other resources to your attackers.
RewriteRule ^(index.php/?)?rss/ - [L,F]
This is an optimized version of the officially suggested rule
RewriteRule ^(index.php/?)?rss/ - [L,R=403]
403 is not a [R]edirect technically. It should work per the docs of mod_rewrite for Apache 2.2+, but it's not fully clear from the docs that it's also supported in earlier versions whereas [F] is the semantically correct way to [F]orbid access ever since. Supply an otherwise implied [L] to support Apache < 2.2.
The reason the official rule doesn't work for you might be because of using an older Apache and corresponding mod_rewrite version. As a result, the rule containing the flag [R=403] as suggested by Magento itself may be skipped under Apache 2.0.
If this is the root cause, then Magento should rework either their system requirements – as they're officially supporting Apache 2.x – or their RSS blocking RewriteRule.
'redirect|R [=code]' (force redirect)
Prefix Substitution with http://thishost[:thisport]/ (which makes the new URL a URI) to force a external redirection. If no code is given, a HTTP response of 302 (MOVED TEMPORARILY) will be returned. If you want to use other response codes in the range 300-400, simply specify the appropriate number or use one of the following symbolic names: temp (default), permanent, seeother. Use this for rules to canonicalize the URL and return it to the client - to translate
/~'' into/u/'', or to always append a slash to /u/user, etc.[...]
[...]
Any valid HTTP response status code may be specified, using the syntax [R=305], with a 302 status code being used by default if none is specified. The status code specified need not necessarily be a redirect (3xx) status code. However, if a status code is outside the redirect range (300-399) then the substitution string is dropped entirely, and rewriting is stopped as if the L were used.
[...]
RewriteEngine on? If not, try doing so. Still not working: make sure you're running apache and not e.g. nginx. check your apache configuration if mod_rewrite is enabled. you then test a simple rule to check if the module is loaded. in case of persisting problems, you might want to check if mod_rewrite settings are allowed to be overridden via .htaccess files.
I just used:
redirect 301 /rss/catalog/notifystock/ http://0.0.0.0
redirect 301 /index.phprss/catalog/notifystock http://0.0.0.0
So it just blocks the access to those domains all together. Works great and has less potential for not working on various server environments.
Be nice if you could log IPs that access those URLs and permanently ban them like Wordfence. Seems like that should be a thing...
