How to Block Referrer Spam Using .htaccess

In some instances, you may notice a surprising spike in traffic but no actual increase to files being requested or overall content being served. This may be an indication that someone is siphoning some of your content, such as images, and attempting to pass it off as their own or perhaps attempting to hack your website. In either case, you can block this type of behavior thanks to the functionality provided by the Apache Web Server and utilizing a .htaccess file. If you have not created a .htaccess file or you're not sure how to edit this file, please refer to the following guide, which covers these topics in more detail: Creating and editing a .htaccess file

Block Referrer URL using htaccess

Please note that the mod_rewrite functionality will need to be enabled on the server that you'll be doing this on for this to work. This functionality is enabled on Hostwinds Shared, Business, and Reseller packages by default. If you're not certain that this functionality is enabled on your server, you may refer to our guide, which covers how to enable the mod_rewrite module: Enable Apache mod_rewrite module.

To block a single referrer, you'll need to add the following code to a .htaccess file.

RewriteEngine on
RewriteCond %{HTTP_REFERER} domaintoblock.com [NC]
RewriteRule .* - [F]

The code above instructs the webserver not to accept connections from the URL domaintoblock.com. If you want to block multiple referrers, you can add additional rewrite conditions like so.

RewriteEngine on
RewriteCond %{HTTP_REFERER} domaintoblock1.com [NC,OR]
RewriteCond %{HTTP_REFERER} domaintoblock2.com
RewriteRule .* - [F]

This code tells the webserver to block requests/traffic originating from domaintoblock1.com and domain to domaintoblock2.com. For both examples, specifying NC ensures that this block is not case-sensitive. If you'd like to block additional referrers, just ensure that you follow the format illustrated in the second example. Generally blocked referrers will receive a 403 error message upon trying to access any portion of your site that is covered by the .htaccess rules outlined in this article.