IP whitelisting according to new Magento best practices

Question

Recently Magento updated the post: "Protect your Magento Installation from Password Guessing", see: https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

While in the original post they advised to put the following in the root .htaccess file:

RewriteCond %{REQUEST_URI} ^.*/ADMIN_PANEL_LOCATION [OR,NC]

RewriteCond %{REQUEST_URI} ^.*/DOWNLOADER [OR,NC]

RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC]

RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [NC]

RewriteCond %{REMOTE_ADDR} !^1.2.3.4

RewriteCond %{REMOTE_ADDR} !^5.6.7.8

RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

Now they seem to recommend the following approach:

# Whitelist an IP address for the admin panel
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

# Whitelist an IP address for the RSS feed
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

and put this in the ./downloader/.htaccess file:

order deny,allow
deny from all
allow from xx.xx.xx.xx

I am not much expert on this subject, so I was wondering:

1. if both the first and second method are good for Magento 1
2. what the difference really is between one approach over the other and if there's one which is better

Answer 1

While both of them are basically ok the second one is still better due to the following reason:

With a return code 302 in the RewriteRule you redirect all these requests (which should not be allowed) to your shops' homepage again, which results in an additional request. If someone starts brute-forcing on these URLs you will generate an additional request, so basically you would support your own DoS.

With a HTTP return code of 403 you might end up on basic 403 page (more or less fancy, depending on server configuration) but there won't be any further requests to your Magento.