Block Tough Proxies

If you want to block tough proxies like hidemyass.com, my previously posted .htaccess methods won’t work. Those methods will block quite a bit of proxy visits to your site, but won’t work on the stealthier proxies. Fortunately, we can use a bit of PHP to keep them out.

Block Tough Proxies with PHP

To stop tough proxy visits from sites like hidemyass.com, add the following slice of finely crafted PHP to the top of your header.php file:

<?php if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
die("Proxy access not allowed"); ?>

If you’re not using WordPress, just place the code at the top of your web page(s). No editing is necessary, so just add the code, upload the file, and done. You can check that it works by visiting your site via your favorite proxy service. If it works, access will be denied.

This method works for me on a Linux server running Apache 2.2.3, MySQL 5.0, and PHP 5.2.6. It should work on similar setups as well, but your results may vary depending on your server configuration.

Block Tough Proxies with WordPress

For WordPress, the technique basically is the same. Only packaged a bit differently to work optimally via WordPress hooks. Here is the code snippet to add via simple plugin or theme functions.php file:

// block proxy visits @ https://m0n.co/01
function shapeSpace_block_proxy_visits() {
	if (@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1)) {
		die('Proxy access not allowed');
	}
}
add_action('after_setup_theme', 'shapeSpace_block_proxy_visits');

Again, you shouldn’t need to add this code unless you specifically are having issues with out-of-control proxy visits. The code works great, but does cost a bit in terms of processing power and other server resources. So use wisely.

Bonus! Conditional blocking

Just a quick bonus snippet for you. Continuing from the previous WordPress technique, here is how you would limit execution of the proxy-blocking to a specific post or page:

// block proxy visits @ https://m0n.co/01
function shapeSpace_block_proxy_visits() {
	
	if (!is_page('chat')) return;
	
	if (@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1)) {
		die('Proxy access not allowed');
	}
	
}
add_action('after_setup_theme', 'shapeSpace_block_proxy_visits');

Notice the only difference here is the addition of the line:

if (!is_page('chat')) return;

That tells the function to stop and not do anything if the current page is named chat. So you can change that to any page you would like.

Update: send response headers

If you are getting incorrect response headers (e.g., getting 200 “OK” for 404 “Not Found” pages). You can resolve by sending the desired header, for example to send 403 “Forbidden” response for any blocked proxy requests:

// block proxy visits @ https://m0n.co/05
function shapeSpace_block_proxy_visits() {
	if (!is_user_logged_in()) {
		if (@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1)) {

			header('HTTP/1.1 403 Forbidden'); // send response header
			die('Proxy access not allowed');
		}
	}
}
add_action('after_setup_theme', 'shapeSpace_block_proxy_visits');

You can change the header to whatever response, etc. Check the PHP documentation for more details.

Block Other Proxies with .htaccess

If for whatever reason you aren’t using the above PHP method, you can still block a majority of the “lesser” proxies by adding the following block of HTAccess code to your site’s root .htaccess file:

# BLOCK PROXY VISITS
# PerishablePress.com: http://bit.ly/12k6Uo
<IfModule mod_rewrite.c>
	RewriteEngine on
	RewriteCond %{HTTP:VIA}                 !^$ [OR]
	RewriteCond %{HTTP:FORWARDED}           !^$ [OR]
	RewriteCond %{HTTP:USERAGENT_VIA}       !^$ [OR]
	RewriteCond %{HTTP:X_FORWARDED_FOR}     !^$ [OR]
	RewriteCond %{HTTP:PROXY_CONNECTION}    !^$ [OR]
	RewriteCond %{HTTP:XPROXY_CONNECTION}   !^$ [OR]
	RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
	RewriteCond %{HTTP:HTTP_CLIENT_IP}      !^$
	RewriteRule .* - [F]
</IfModule>

This proxy-blocking technique is less-effective than the PHP method, but should help reduce overall proxy traffic to your site. Using HTAccess to filter proxies requires fewer system resources than the PHP method. So if you get tons of traffic or have lots of pages, you’re better off sticking with the HTAccess technique. It’s sort of a trade-off between effective proxy-blocking and optimum performance, which will vary depending on your needs and server configuration.

My Strategy

On most of my personal sites, I allow proxy access. I understand the need for privacy, but there are situations where denying proxy visits makes sense. Most often, the .htaccess code is a suitable solution. But for sites where anonymity isn’t an option, the PHP method is the way to go.

About the Author

Jeff Starr = Web Developer. Security Specialist. WordPress Buff.