Drupal's .htaccess does not deny access to nodes

Question

D7, .htaccess woes. I'm trying to deal with referer spam in my Statistics module and block the most notorious referers. I edited my .htaccess file like this:

# Follow symbolic links in this directory.
Options +FollowSymLinks

# ... some options ....

# Various rewrite rules.
<IfModule mod_rewrite.c>
    RewriteEngine on

    # ... some more options ....

    # Block referer spam
    RewriteCond %{HTTP_REFERER} spamhost1\.com [NC,OR]
    RewriteCond %{HTTP_REFERER} spamhost2\.com
    RewriteRule .* - [F]
</IfModule>

When I went on to test this setup, I found out that it works correctly only if I try to access my site's main page. This request results in a correct 403 response:

GET http://www.example.com/ HTTP/1.1
referer: http://spamhost1.com/
Host: www.example.com

But any request to a node page produces 200 OK and loads the page which I'm trying to block:

GET http://www.example.com/node/1 HTTP/1.1
referer: http://spamhost1.com/
Host: www.example.com

Is it a matter of the Apache configuration in my server? How do I deny access to node pages?

Answer 1

In your settings.php file you can add the following lines and upon recognition of an HTTP_REFERER Drupal will not deliver any page data.

if ($_SERVER['HTTP_REFERER'] == 'http://spamhost1.com') {
  exit;
}

You should consider looking into existing modules that block spam though. Trying to manage this one URL at a time seems like a lot of work.