mod security rules to block get requests by url

ipel

• April 17, 2015 09:57

In the last days in my VPS there are many many GET requests on 1 file that cause a high memory load (all came from a single referer, but with different IPs). Until now I've blocked these requests via .htaccess, but in this way the requests are still processed by apache and still cause an high memory load.. Can I block this requests with mod_security v2 (maybe on phase1) to prevent/decrease the memory load? I think is possible to block the requests by referer or by querystring (because are always the same), but what rules should I use? Example of logs here:

• 

  cPanelMichael

  • April 20, 2015 15:27

  Hello, There's a third-party blog post at the following URL that should help you to understand the process of creating a new rule if that's something you would like to do:

  0
• 

  quizknows

  • April 21, 2015 00:22

  There are plenty of ways to block. If you want to block based on the referrer, use something like this: SecRule HTTP_REFERER "

  0

Please sign in to leave a comment.