Knowledge Base

Many automated scanning tools, cybersecurity software, and attack bots attempt to gain access to your server through open ports or known vulnerabilities. Requests made by pentest software, security firms, or automation systems, in particular, can strain your system. Therefore, security measures should be taken at both the SSH and Apache levels. In this guide, we will explain how to block proxy access and bot scans with .htaccess, as well as direct access restrictions via SSH.

1. Blocking Proxy and Security Scanning Bots with .htaccess

A) Blocking Known Proxy & Pentest User-Agents

RewriteEngine On

# User-Agent based blocking
SetEnvIfNoCase User-Agent ".*(sqlmap|nikto|acunetix|netsparker|nessus|scanner|libwww).*" bad_bot
Order Allow,Deny
Allow from all
Deny from env=bad_bot

B) Blocking Known IP Ranges (e.g., Shodan, Censys, etc.)

<Limit GET POST>
Order Allow,Deny
Allow from all
Deny from 71.6.135.0/24
Deny from 89.248.165.0/24
Deny from 104.131.0.0/16
</Limit>

C) Proxy Header Check

RewriteCond %{HTTP:X-Forwarded-For} !^$
RewriteRule ^(.*)$ - [F,L]

RewriteCond %{HTTP:VIA} !^$
RewriteRule ^(.*)$ - [F,L]

These rules check whether the incoming request is coming through a proxy and block it if it is.

2. SSH Access Restrictions

A) Disable Root Login

Open the /etc/ssh/sshd_config file:

sudo nano /etc/ssh/sshd_config

Find the following line and change it as follows:

PermitRootLogin no

B) Grant SSH Access Only to Specific IPs

echo "sshd: 31.143.234.25 : allow" | sudo tee -a /etc/hosts.allow
echo "sshd: ALL : deny" | sudo tee -a /etc/hosts.deny

C) Change the SSH Port

Port 2222  # Example: instead of 22

To apply:

sudo systemctl restart sshd

3. Extra Recommendations

• Prevent brute-force attacks with Fail2Ban.

• If you are using Cloudflare, add ASN blocking, country blocking, and WAF rules.

• Perform automatic attack detection with Imunify360, CSF, or similar server security software.

With these simple but effective measures to be taken at both the .htaccess and SSH levels, your server becomes much more resistant to cyber attacks. Security should be provided with a layered approach and constantly monitored. In particular, blocking known pentest software and proxy-based scans helps you stop attackers early.