Blocking IPs with .htaccess Afdrukken

Block unwanted IPs from accessing your website using Apache's .htaccess file.

Block Single IP

Add to your .htaccess file:

order allow,deny
deny from 192.168.1.100
allow from all

Block Multiple IPs

order allow,deny
deny from 192.168.1.100
deny from 10.0.0.50
deny from 203.0.113.0
allow from all

Block IP Range

Using CIDR notation:

order allow,deny
deny from 192.168.1.0/24
allow from all

Using partial IP:

order allow,deny
deny from 192.168.1.
allow from all

Block by Country (Using GeoIP)

If mod_geoip is enabled:

GeoIPEnable On
SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry
deny from env=BlockCountry

Allow Only Specific IPs

Whitelist approach (blocks everyone except listed IPs):

order deny,allow
deny from all
allow from 192.168.1.100
allow from 203.0.113.50

Block Bad Bots

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (AhrefsBot|MJ12bot|SemrushBot) [NC]
RewriteRule .* - [F,L]

Rate Limiting (Apache 2.4+)

Prevent brute force attacks:

<If "%{REQUEST_URI} =~ m#^/wp-login\.php#">
    SetEnvIf Remote_Addr "^" dos_attempt
    <RequireAll>
        Require all granted
        Require not env dos_attempt
    </RequireAll>
</If>

Finding IPs to Block

Check your access logs:

# Most frequent IPs
awk '{print $1}' access.log | sort | uniq -c | sort -nr | head -20

# IPs hitting wp-login.php
grep "wp-login.php" access.log | awk '{print $1}' | sort | uniq -c | sort -nr

# 404 errors by IP
awk '$9 == 404 {print $1}' access.log | sort | uniq -c | sort -nr

Testing Your Rules

Test without blocking yourself:

# Add your IP to whitelist first
order allow,deny
allow from YOUR.IP.HERE
deny from 192.168.1.100
allow from all

Common Patterns to Block

Suspicious requests:

RewriteEngine On
# Block SQL injection attempts
RewriteCond %{QUERY_STRING} (union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|script|set|md5|benchmark) [NC]
RewriteRule .* - [F,L]

# Block common exploits
RewriteCond %{REQUEST_URI} (wp-config\.php|xmlrpc\.php|/\.git|/\.env) [NC]
RewriteRule .* - [F,L]

Performance Note

For many IPs (100+), use a firewall instead:

# Better performance with iptables
iptables -A INPUT -s 192.168.1.100 -j DROP

# Or with UFW
ufw deny from 192.168.1.100

Important

• .htaccess is processed on every request - impacts performance
• Always test rules on staging first
• Keep backups of working .htaccess files
• Some hosting providers disable .htaccess overrides