I don't get spam either, mostly because I don't allow user registrations at all. That doesn't prevent them from visiting and filling out my webforms with garbage that I later have to filter.
Anyway, I've been trying a new .htaccess file for the past week and have noticed nothing but silence. The guy that put it together updates it religiously so whatever new crap he finds he adds to the file rather quickly. While i-frame threats are not the specific focus, securing the site from any kind of threat is.
The main idea here is that I want real visitors to have total access to my site.
Here's what the guy does in his own words...
Quote:
|
When I detect hostile or unwanted activity in my access logs I note the IP addresses from which these events emanated. Then I run them through specialized lookup tools to determine whether they came from residential or business computers - via an ISP, or from a web hosting company's servers, a proxy service, or from a co-located server in a data center. Since residential customers usually have dynamic or semi-static IP addresses, which are frequently changed by their ISPs, it makes no sense to block them. The next person who is assigned that IP may be a potential customer! Instead, I concentrate most of my efforts on blocking servers, which have static (non-changing) IP's. Additionally, I identify businesses with static IP's, who have compromised workstations and file servers that are controlled by hackers and spammers and which are trying to mess with my logs or my website security. With the exception of co-located and privately owned servers, almost all of these offending visitors (human and robot) come from companies that are assigned ranges of IP addresses, which are called a CIDR. Some CIDRs are very small (4 to 8 IP's), while others may include thousands of usable addresses. Once I determine that a hostile action came from a server and not an ISP, I lookup the CIDR to which it belongs and add it to a blocklist.
|
I'll post a copy of the .htaccess soon. I had to compile it from 4 sources but it was easier to do than I originally thought.