Block Domains & Subdomains Using .htaccess
A large focus of my redesign was improving site speed, and in doing so, I took a look at my site's error_log for the first time in a long time. I was shocked when I found out that 90% of my site errors were either hacking attempts or hot-linked files from hundreds of different tumblr.com subdomains. Thousands upon thousands of PHP fatal errors due to lack of memory saw me seeing red pretty quick -- no wonder I was having periodical speed issues! Luckily this bit of .htaccess code allows me block all of those sites:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*tumblr\.com [NC]
RewriteRule .* - [F]
</IfModule>
These days I only see PHP notices in my error_log, and that makes me a very happy man. I've also noticed less SPAM commenting, so maybe Tumblr is used a SPAM hub too? Either way, blocking domains and subdomains did the trick for me!
![Page Visibility API]()
One event that's always been lacking within the document is a signal for when the user is looking at a given tab, or another tab. When does the user switch off our site to look at something else? When do they come back?
![LightFace: Facebook Lightbox for MooTools]()
One of the web components I've always loved has been Facebook's modal dialog. This "lightbox" isn't like others: no dark overlay, no obnoxious animating to size, and it doesn't try to do "too much." With Facebook's dialog in mind, I've created LightFace: a Facebook lightbox...
![CSS Kwicks]()
One of the effects that made me excited about client side and JavaScript was the Kwicks effect. Take a list of items and react to them accordingly when hovered. Simple, sweet. The effect was originally created with JavaScript but come five years later, our...
![Highlighter: A MooTools Search & Highlight Plugin]()
Searching within the page is a major browser functionality, but what if we could code a search box in JavaScript that would do the same thing? I set out to do that using MooTools and ended up with a pretty decent solution.
The MooTools JavaScript Class
The...
There are 2 issues with your solution:
1) If a legit person linked to your blog from their Tumblr blog, people would see a Forbidden message. This is because you have your images under the same domain as the blog. Keeping them on the sub-domain would save your visitors from this.
2) Security – probably a minor issue, but when you get a Forbidden message from Apache, you also get a path to the content you were forbidden to access. And since you are using WordPress with caching, the message looks as follows:
Forbidden
You don't have permission to access /wp-content/w3tc/pgcache//block-domain/_index_search_engines.html_gzip on this server.
Apache/2.2.3 (CentOS) Server at davidwalsh.name Port 80
Thanks for sharing Shimon. Per your points:
1. If it’s only specific subdomains hurting you, listing them one by one would be best, I agree. In my case, I don’t care if legit Tumblr sites are linking to me. :)
2. I’ll look into the Forbidden issue — thanks!
Wow. blocking anyone comming from tumblr seems pretty extreme to me, you could at least add a RewriteCond to block only static content.
Seems like a lot of work, when this doesn’t even require mod_rewrite:
deny from .tumbler.com