Skip to content

Instantly share code, notes, and snippets.

@zohaibhassan156

zohaibhassan156/Block bad bot and sensitive file requests.txt

Last active August 14, 2025 18:15
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save zohaibhassan156/157bd86c44262d0597872057bc74ac64 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save zohaibhassan156/157bd86c44262d0597872057bc74ac64 to your computer and use it in GitHub Desktop.
Download ZIP
Block bad bot / sensitive file requests
Raw
Block bad bot and sensitive file requests.txt
RewriteEngine On
# ======================
# Block bad bot / sensitive file requests
# ======================
# ---- Anywhere in URL ----
# Blocks .env in any position (e.g., /apps/.env.production.local)
RewriteCond %{REQUEST_URI} .*\.env [NC,OR]
# Blocks "settings." in any position (e.g., /config/settings.py)
RewriteCond %{REQUEST_URI} .*settings\. [NC,OR]
# Blocks WordPress paths appearing anywhere in the URL
RewriteCond %{REQUEST_URI} wp-(includes|admin|content|config) [NC,OR]
# ---- Start-of-path matches ----
# Blocks exact sensitive files if requested from root or relative paths
RewriteCond %{REQUEST_URI} ^/+(aws-secret\.yaml|vendor/|sitemap\.xml|wp-login\.php|\.DS_Store|\.env|\.well-known|config/|etc/|app/) [NC]
# Final action: deny with 403 Forbidden
RewriteRule .* - [F,L]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment