2

Our server is being hit with spam requests related to new membership via a url query. The query looks like /index.php?ACT=8&id=G3UISGtdz, with the id changing. This is an older EE 1.6.8 site. I have disabled new membership, but the request keep coming.

Is there a way to stop this?

Improve this question
3
  • Contact your server hosting company and ask to ban the ip that keeps making these requests. If you are in control of the server, then blacklist the ip. If there are multiple ip addresses then you have a much more serious problem.
    – Johnathan Waters
    Commented Feb 25, 2014 at 21:28
  • Thanks. I do have control server, but it is multiple ip addresses. Is there somewhere in the code I can stop ACT=8 from firing? Eventually however I need to allow new memberships.
    – user1332211
    Commented Feb 25, 2014 at 21:46
  • 1
    Maybe for now you should look into just blocking that type of request with the .htaccess
    – Johnathan Waters
    Commented Feb 25, 2014 at 21:54

1 Answer 1

Reset to default
1

Have a look at this question on StackOverflow: How to block bot requests to URLs that match a common pattern in Apache?

Drop this in your .htaccess file. It will match any variation of the querystring that you seem to be getting spammed on. With this mod_rewrite rule, if a querystring tries to fire ACT=8, the Apache will simply respond with a 403 Forbidden.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} ^.*(ACT=8).* [NC]
RewriteRule ^.*$ - [F,L]
</IfModule>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.