Simple web application firewall using .htaccess

leaseweb.com

4 pointsmaus804 comments

huge WTF...you can't call that WAF...At least try adding some more rules.

Hell, .htaccess being ENABLED is borderline WTF on a real production server.

I don't think they know what a WAF actually is.

Blocking IP addresses in an .htaccess file? That's literally* what a firewall is for.

*metaphysically?

The problem is, the request still hits Apache, so you can still get DDOSed.

A proper WAF will drop requests before they hit the web server software, or even better, before hitting the server at all.