2 village_idiot Jul 28, 2007 10:11
![](https://forums.b2evolution.net/media/users/village_idiot/profile_pictures/.evocache/1537113145457d9cb61adc1.gif/crop-top-80x80.gif?mtime=1372015408)
I should add also that nearly 99.9999% of those attempts are going to be scripted. Consequently, you can block them by NOT allowing anything with the user-agent libwww-perl to access your site (anywhere).
Theres NO reason why anyone should be access a web site that isn't theirs using any sort of perl script.
I do it using mod_rewrite, but it can be handled via mod_access also.
Here is the mod_rewrite way:
RewriteCond %{HTTP_USER_AGENT} SiteSucker [NC,OR]
RewriteCond %{HTTP_USER_AGENT} LWP::Simple [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lwp-trivial [NC,OR]
RewriteCond %{HTTP_USER_AGENT} libwww-perl [NC]
RewriteRule ^.*$ - [F]
I block a whole host of potential includes using mod_security, even though I also block libwww-perl - mainly because someone that is serious, and not just a script kiddy can and probably would provide a different user-agent.
Nice but Apache logs are much more useful..
those are all just php include attacks..
mod_security takes care of just about every permutation of php include attacks there is, if you have it available.