2

I need to block RSS pages in htaccess, most importantly these

/rss/catalog/new
/rss/catalog/notifystock

and

/index.phprss/catalog/notifystock

Especially the last one, as you can see it's /index.phprss/ without a slash in between, it works when added in front of domain name, I need to block it.

Could someone please add a rewrite code?

5

Rule works on 1.7:

RewriteCond %{REQUEST_URI} ^/(index.php/?)?rss/ [NC]
RewriteCond %{REMOTE_ADDR} !^1.1.1.1
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

The rule below is the rule Magento instructions provide, it doesn't work.

############################################
## make HTTPS env vars available for CGI mode

    SSLOptions StdEnvVars

</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

If anyone see issues with the original rule, please let me know.

  • you should remove the line containing the remote_addr condition if you didn't intend to allow IPs 1.1.1.1?? to access rss urls. – pong Nov 5 '16 at 21:46
  • Great, the rule works perfectly it blocks all rss pages.... I am note exactly sure why magento guidelines required RewriteRule ^(index.php/?)?rss/ - [L,R=403] – Icon Nov 5 '16 at 21:52
  • I just set the official rule (see my answer) for different installations and it worked flawlessly. Did you put it right below RewriteEngine on? You should really consider using the official rule since your rule creates a full Magento instance by redirecting to home for each request that tries hacking your store - no one else will access those urls so you are sacrificing performance and other resources to your attackers. – pong Nov 7 '16 at 9:32
  • @pong could you please attach a copy of the full rule and where exactly you are putting it? Also, which version of magento you tried it on? – Icon Nov 7 '16 at 14:44
  • @pong I Tried adding the rules code to the access file including RewriteEngine on. Doesnt work. See my answer, I attache my full rule which works and which doesnt work. – Icon Nov 7 '16 at 14:58
1
RewriteRule ^(index.php/?)?rss/ - [L,F]

This is an optimized version of the officially suggested rule

RewriteRule ^(index.php/?)?rss/ - [L,R=403]

403 is not a [R]edirect technically. It should work per the docs of mod_rewrite for Apache 2.2+, but it's not fully clear from the docs that it's also supported in earlier versions whereas [F] is the semantically correct way to [F]orbid access ever since. Supply an otherwise implied [L] to support Apache < 2.2.

The reason the official rule doesn't work for you might be because of using an older Apache and corresponding mod_rewrite version. As a result, the rule containing the flag [R=403] as suggested by Magento itself may be skipped under Apache 2.0.

If this is the root cause, then Magento should rework either their system requirements – as they're officially supporting Apache 2.x – or their RSS blocking RewriteRule.

v2.0 docs on R flag

'redirect|R [=code]' (force redirect)

Prefix Substitution with http://thishost[:thisport]/ (which makes the new URL a URI) to force a external redirection. If no code is given, a HTTP response of 302 (MOVED TEMPORARILY) will be returned. If you want to use other response codes in the range 300-400, simply specify the appropriate number or use one of the following symbolic names: temp (default), permanent, seeother. Use this for rules to canonicalize the URL and return it to the client - to translate /~'' into/u/'', or to always append a slash to /u/user, etc.

[...]

v2.2 and v2.4 docs on R flag

[...]

Any valid HTTP response status code may be specified, using the syntax [R=305], with a 302 status code being used by default if none is specified. The status code specified need not necessarily be a redirect (3xx) status code. However, if a status code is outside the redirect range (300-399) then the substitution string is dropped entirely, and rewriting is stopped as if the L were used.

[...]

  • Doesnt work when inserted alone. Need full rule – Icon Nov 5 '16 at 21:23
  • this is the full rule. is mod_rewrite enabled at all? – pong Nov 5 '16 at 21:26
  • How to check if its enabled? – Icon Nov 5 '16 at 21:29
  • very first step to check: did you put the rule below the line stating RewriteEngine on? If not, try doing so. Still not working: make sure you're running apache and not e.g. nginx. check your apache configuration if mod_rewrite is enabled. you then test a simple rule to check if the module is loaded. in case of persisting problems, you might want to check if mod_rewrite settings are allowed to be overridden via .htaccess files. – pong Nov 5 '16 at 21:38
  • I will take a look whether mod_rewrite is working. I found a work around. Take a look at a rule I have modified, that seems to block RSS pages. I will post in in another Answer just below. Let me know what you think. – Icon Nov 5 '16 at 21:40
0

I just used:

redirect 301 /rss/catalog/notifystock/ http://0.0.0.0 
redirect 301 /index.phprss/catalog/notifystock  http://0.0.0.0

So it just blocks the access to those domains all together. Works great and has less potential for not working on various server environments.

Be nice if you could log IPs that access those URLs and permanently ban them like Wordfence. Seems like that should be a thing...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.