Block IPs with .htaccess

For broad protection against bad bots, there is the incoming firewall (WAF), currently in testing. A handful of known IPs need no more than a few .htaccess rules.

# Block a single IP

fortrabbit runs Apache 2.4 and also accepts the older 2.2 access syntax. The 2.4 syntax uses Require:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.42
</RequireAll>

Everyone keeps access except that one address, which gets a 403 Forbidden. The same rule in the 2.2 syntax:

Order Allow,Deny
Allow from all
Deny from 203.0.113.42

# Block an IP range

Pass a CIDR block to cover a whole range at once. This blocks all of 198.51.100.0/24:

<RequireAll>
    Require all granted
    Require not ip 198.51.100.0/24
</RequireAll>

The network prefix alone works too: Require not ip 198.51.100 blocks the same /24. In 2.2 syntax: Deny from 198.51.100.0/24.

# Block several addresses

Stack as many lines as you need inside one block:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.42
    Require not ip 198.51.100.0/24
    Require not ip 192.0.2.0/24
</RequireAll>

# With password protection on

While the dashboard password protection is on, Apache does not allow Require in .htaccess, and the file answers every request with a 500 error. Use the 2.2 syntax then; it works in both cases:

Order Allow,Deny
Allow from all
Deny from 203.0.113.42
Deny from 198.51.100.0/24

Do not mix both syntaxes in one file.

# Allow only certain IPs

The inverse lets in one address only, for example during maintenance:

<RequireAll>
    Require ip 203.0.113.42
</RequireAll>

For a staging area, HTTP auth also works for people without a fixed IP.

# Alternatives