Flashes of Panic

…I’d be filtering visitors to this site based on where they’re coming from.

The thing is, they’re not really visiting, nor are they coming from where they say they’re coming from; they’re just requesting a page with a bogus referrer (and probably just routing the response to /dev/null.) They’re hoping I’ve got some sort of page somewhere which lists referrers (either recent, or most active) and that they’ll be picked up by the Googlebot.

One in particular, “locators dot com” (I’m not linking them for obvious reasons) was making such bogus requests a few dozen times a day, with various bogus subdirectories on their site attempting to attract search terms. So I dropped them in the site .htaccess file, right below the comment spam hack (which has been remarkably effective, by the way.)

If you’ve got direct access to your file tree and your host is using Apache, you can upload a file named .htaccess to the root of your site. (Some hosts may not allow this.) Here’s what’s in mine:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} !.mt-tb\.cgi*
RewriteCond %{REQUEST_URI} !.mt-xmlrpc\.cgi*
RewriteCond %{HTTP_REFERER} !.*flashesofpanic\.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^-$
RewriteRule (.*) /post_error.php [R,L]
RewriteCond %{HTTP_REFERER} locators\.com
RewriteRule (.*) /post_error.php [R,L]

The first line turns on mod_rewrite. The next six implement Kasia’s comment spam hack, with a modification to allow access for ecto and my domain name rather than hers (obviously.) The last two lines send the bogus referrers from the slimeballs to the same error page. (Notice that you’ll have to create an error page to direct the slimeballs to.) Obviously, you can duplicate the next-to-last line (with an [OR] flag) for other slimeballs’ domains, create a custom error page for them (how about Cannot Find Life?) or other creative ideas. Notice that you need to escape the dots in domain names, because . is a wildcard character in regular expressions, which is the pattern-matching engine mod_rewrite uses but is far too complicated for me to get started on here.

I also suspect I could just deliver 404s to the referrer spammers without using mod_rewrite at all—maybe mod_access. I haven’t looked in to that yet.

As usual, your mileage may vary. I’m not claiming that this file won’t lock down your site, crash your host’s server, DOS everyone in your bookmarks, or forward all your ex’s archived email to your mother; I’m just saying it works for me.

Now playing: Unsatisfied from Let It Be by The Replacements