Blocking Countries with htaccess
-
Hi there,
I run about 20 WordPress sites for different customers in a single webspace. We’ve had hacking problems in the past but through security plugins, regular updating and most importantly htaccess blocking we have reduced attacks to pretty much zero.
The issue is that my .htaccess file in the webspace root blocks so many countries that each site can take 5-10 seconds to load. This is not ideal, so I wondered what the quickest way to block countries would be?
At present we block countries individually (please see code below), but I wondered if I could change it to allow only the UK and Western Europe and block everything else, and if that would be a lot quicker?
I can’t seem to post all the code as there is so much!
I’ve included just a taste but there’s hundreds of IP ranges in the full htaccess file.
# BLOCK COUNTRY BY IP RANGE # IncrediBILL's HTACCESS Tools # http://incredibill.me <Limit GET POST HEAD> order allow,deny # # Block from AFGHANISTAN (AF) # deny from 27.116.56.0/22 deny from 58.147.128.0/19 deny from 61.5.192.0/20 deny from 103.5.172.0/22 deny from 103.5.196.0/23 deny from 103.7.104.0/22 deny from 103.12.96.0/22 deny from 103.13.64.0/22 deny from 103.14.24.0/24 deny from 103.15.238.0/23 deny from 103.17.60.0/22 deny from 103.17.165.0/24 deny from 103.17.166.0/23 deny from 103.18.160.0/22 deny from 103.23.36.0/22 deny from 103.23.247.0/24 deny from 103.28.132.0/22 deny from 103.30.136.0/22 deny from 103.244.144.0/22 deny from 103.247.198.0/24 deny from 111.125.152.0/21 deny from 111.223.244.0/22 deny from 117.55.192.0/20 deny from 117.104.224.0/21 deny from 119.59.80.0/21 deny from 121.100.48.0/21 deny from 121.127.32.0/19 deny from 124.199.112.0/20 deny from 125.213.192.0/19 deny from 175.106.32.0/19 deny from 180.94.64.0/19 deny from 180.222.136.0/21 deny from 182.50.176.0/20 deny from 202.56.176.0/20 deny from 202.86.16.0/20 deny from 203.174.27.0/24 deny from 203.215.32.0/20 deny from 210.80.0.0/19 deny from 210.80.32.0/19 deny from 91.109.216.0/21 deny from 193.201.151.64/26 # # Block from ALBANIA (AL) # deny from 31.22.48.0/20 deny from 31.44.64.0/20 deny from 31.171.152.0/21I would have thought there would be a simple ‘allow’ function that I can include and ‘deny’ everywhere else.
I’ve not done this bfore, but I believe you could do something like this (this is supposedly US IPs only, you’ll need to find the others):
order deny,allow deny from all allow from IP 60.254.128.0/18 103.246.248.0/24 113.29.0.0/17 163.60.0.0/16 192.103.43.0/24 202.72.96.0/20 203.144.48.0/20 203.187.128.0/19 179.60.192.0/22 190.103.184.0/22 200.49.248.0/21 5.152.184.0/21 31.170.160.0/21 37.18.176.0/21 46.22.64.0/20 46.231.240.0/21 88.151.224.0/21 89.255.192.0/18 93.183.0.0/18 93.184.208.0/20 93.188.128.0/21 109.70.88.0/21 141.0.8.0/21 149.154.0.0/18 176.67.80.0/21 212.1.208.0/21 213.137.64.0/19 87.76.16.0/20 87.239.136.0/21 91.205.100.0/22 91.209.6.0/24 91.209.57.0/24 91.223.191.0/24 91.225.248.0/22 130.26.0.0/16 165.218.0.0/16 176.120.16.0/21 193.34.36.0/22 193.58.216.0/21 193.105.173.0/24 193.138.72.0/24 193.160.33.0/24 193.164.220.0/23 193.201.252.0/22 193.203.8.0/21 193.254.198.0/23 194.42.216.0/24 194.110.160.0/22 194.153.155.0/25 195.42.132.0/23 195.66.102.0/24 195.66.132.0/23 195.190.24.0/24 195.200.84.0/23 195.216.225.0/24 195.230.108.0/24Also, you may want to try something like the iQ Block Country plugin. Once again with the caveat that I haven’t done this myself.
That’s great – appreciate it!
This [iQ Block Country] plugin uses the GeoLite database from Maxmind…
…it will try to download the GeoIP database from Maxmind so you will always have a recent version of the database when installing this plugin.
I would investigate that a bit before using that plugin. What you do *not* want to do is to add hundreds or even thousands of lines of IP blocks to htaccess. However, the Wordfence Security plugin has a Premium Service for an affordable price that will block countries dynamically such as I have done at a site that now only accepts traffic from USA, Canada and Ireland (since the site owner has a friend there). To do the same thing at htaccess, I would have had to add something like 44,000 lines of IP blocks and my host told me to definitely *not* do that (or my account would likely be suspended for dragging their servers down).
http://wordpress.org/plugins/search.php?q=Wordfence+SecurityI would have had to add something like 44,000 lines of IP blocks and my host told me to definitely *not* do that
Hehe that’s exactly what I’ve got – 43,700 lines in my htaccess. It works great but is too slow at site loading. I just thought I should be able to reverse it, add the ranges to ‘allow’ and then have a default ‘deny’ instruction to everywhere else. I’ll put it together and paste it here to see if you think it would work.
I only really want a single measure to block access to the whole of the webspace (and the 20-odd wordpress sites), rather than installing a plugin on every site…
I’ve been trying to create a list of allowed countries and that creates nearly 80,000 lines for the htaccess so think I may have answered my own question! I guess the western European countries have many more IP ranges than the countries I’m currently blocking so I think I’ll have to stay with what I’ve got. Many thanks for all your help.
That’s great! Thanks for it. I will try on http://canadacarlist.com
- The topic ‘Blocking Countries with htaccess’ is closed to new replies.