D7, .htaccess woes. I'm trying to deal with referer spam in my Statistics module and block the most notorious referers. I edited my .htaccess file like this:

# Follow symbolic links in this directory.
Options +FollowSymLinks

# ... some options ....

# Various rewrite rules.
<IfModule mod_rewrite.c>
    RewriteEngine on

    # ... some more options ....

    # Block referer spam
    RewriteCond %{HTTP_REFERER} spamhost1\.com [NC,OR]
    RewriteCond %{HTTP_REFERER} spamhost2\.com
    RewriteRule .* - [F]

When I went on to test this setup, I found out that it works correctly only if I try to access my site's main page. This request results in a correct 403 response:

GET http://www.example.com/ HTTP/1.1
referer: http://spamhost1.com/
Host: www.example.com

But any request to a node page produces 200 OK and loads the page which I'm trying to block:

GET http://www.example.com/node/1 HTTP/1.1
referer: http://spamhost1.com/
Host: www.example.com

Is it a matter of the Apache configuration in my server? How do I deny access to node pages?

1 Answer 1


In your settings.php file you can add the following lines and upon recognition of an HTTP_REFERER Drupal will not deliver any page data.

if ($_SERVER['HTTP_REFERER'] == 'http://spamhost1.com') {

You should consider looking into existing modules that block spam though. Trying to manage this one URL at a time seems like a lot of work.

  • Sorry, but my question was specifically about .htaccess. And I don't have that many spammers coming to my site, so dealing with them with just .htaccess seems reasonable (at least for now).
    – Ari Linn
    Commented Mar 28, 2016 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.