Latest TweetsGreat post about the latest power grab:…
Perishable Press

The Perishable Press 4G Blacklist

[ 4G Stormtrooper ] At last! After many months of collecting data, crafting directives, and testing results, I am thrilled to announce the release of the 4G Blacklist! The 4G Blacklist is a next-generation protective firewall that secures your site against a wide range of automated attacks and other malicious activity.

Update: Check out the new and improved 6G Blacklist/Firewall »

Like its 3G predecessor, the 4G Blacklist is designed for use on Apache servers and is easily implemented via HTAccess or the httpd.conf configuration file. In order to function properly, the 4G Blacklist requires two specific Apache modules, mod_rewrite and mod_alias. As with the third generation of the blacklist, the 4G Blacklist consists of multiple parts:

  • HTAccess Essentials
  • Request-Method Filtering
  • IP Address Blacklist
  • Query-String Blacklist
  • URL Blacklist

Each of these methods is designed to protect different aspects of your site. They may be used independently, mixed and matched, or combined to create the complete 4G Blacklist. This modularity provides flexibility for different implementations while facilitating the testing and updating process. The core of the 4G Blacklist consists of the last two methods, the Query-String and URL Blacklists. These two sections provide an enormous amount of protection against many potentially devastating attacks. Everything else is just icing on the cake. Speaking of which, there are also two more completely optional sections of the 4G Blacklist, namely:

These two sections have been removed from the 4G Blacklist and relegated to “optional” status because they are no longer necessary. Put simply, the 4G Blacklist provides better protection with fewer lines of code. Even so, each of these blacklists have been updated with hundreds of new directives and will be made available here at Perishable Press in the near future. But for now, let’s return to the business at hand..

Presenting the Perishable Press 4G Blacklist

As is custom here at Perishable Press, I present the complete code first, and then walk through the usage instructions and code explanations. So, without furhter ado, here is the much-anticipated 4G Blacklist [for personal use only – may not be posted elsewhere without proper link attribution]:


RewriteEngine on
ServerSignature Off
Options All -Indexes
Options +FollowSymLinks

<IfModule mod_rewrite.c>
 RewriteRule ^(.*)$ - [F,L]

 Order Allow,Deny
 Allow from all
 Deny from   "# blacklist candidate 2008-01-02 = admin-ajax.php attack "
 Deny from  "# blacklist candidate 2008-02-10 = cryptic character strings "
 Deny from   "# blacklist candidate 2008-03-09 = block administrative attacks "
 Deny from   "# blacklist candidate 2008-04-27 = block clam store loser "
 Deny from "# blacklist candidate 2008-05-31 = block _vpi.xml attacks "
 Deny from   "# blacklist candidate 2008-10-19 = block mindless spider running "
 Deny from  "# 1048 attacks in 60 minutes"
 Deny from    "# 1629 attacks in 90 minutes"

<IfModule mod_rewrite.c>
 RewriteCond %{QUERY_STRING} \.\.\/    [NC,OR]
 RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
 RewriteCond %{QUERY_STRING} tag\=     [NC,OR]
 RewriteCond %{QUERY_STRING} ftp\:     [NC,OR]
 RewriteCond %{QUERY_STRING} http\:    [NC,OR]
 RewriteCond %{QUERY_STRING} https\:   [NC,OR]
 RewriteCond %{QUERY_STRING} mosConfig [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|'|"|;|\?|\*).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(%22|%27|%3C|%3E|%5C|%7B|%7C).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(globals|encode|config|localhost|loopback).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC]
 RewriteRule ^(.*)$ - [F,L]

<IfModule mod_alias.c>
 RedirectMatch 403 \,
 RedirectMatch 403 \:
 RedirectMatch 403 \;
 RedirectMatch 403 \=
 RedirectMatch 403 \@
 RedirectMatch 403 \[
 RedirectMatch 403 \]
 RedirectMatch 403 \^
 RedirectMatch 403 \`
 RedirectMatch 403 \{
 RedirectMatch 403 \}
 RedirectMatch 403 \~
 RedirectMatch 403 \"
 RedirectMatch 403 \$
 RedirectMatch 403 \<
 RedirectMatch 403 \>
 RedirectMatch 403 \|
 RedirectMatch 403 \.\.
 RedirectMatch 403 \/\/
 RedirectMatch 403 \%0
 RedirectMatch 403 \%A
 RedirectMatch 403 \%B
 RedirectMatch 403 \%C
 RedirectMatch 403 \%D
 RedirectMatch 403 \%E
 RedirectMatch 403 \%F
 RedirectMatch 403 \%22
 RedirectMatch 403 \%27
 RedirectMatch 403 \%28
 RedirectMatch 403 \%29
 RedirectMatch 403 \%3C
 RedirectMatch 403 \%3E
 RedirectMatch 403 \%3F
 RedirectMatch 403 \%5B
 RedirectMatch 403 \%5C
 RedirectMatch 403 \%5D
 RedirectMatch 403 \%7B
 RedirectMatch 403 \%7C
 RedirectMatch 403 \%7D
 Redirectmatch 403 \_vpi
 RedirectMatch 403 \.inc
 Redirectmatch 403 xAou6
 Redirectmatch 403 db\_name
 Redirectmatch 403 select\(
 Redirectmatch 403 convert\(
 Redirectmatch 403 \/query\/
 RedirectMatch 403 ImpEvData
 Redirectmatch 403 \.XMLHTTP
 Redirectmatch 403 proxydeny
 RedirectMatch 403 function\.
 Redirectmatch 403 remoteFile
 Redirectmatch 403 servername
 Redirectmatch 403 \&rptmode\=
 Redirectmatch 403 sys\_cpanel
 RedirectMatch 403 db\_connect
 RedirectMatch 403 doeditconfig
 RedirectMatch 403 check\_proxy
 Redirectmatch 403 system\_user
 Redirectmatch 403 \/\(null\)\/
 Redirectmatch 403 clientrequest
 Redirectmatch 403 option\_value
 RedirectMatch 403 ref\.outcontrol
 RedirectMatch 403 errors\.
 RedirectMatch 403 config\.
 RedirectMatch 403 include\.
 RedirectMatch 403 display\.
 RedirectMatch 403 register\.
 Redirectmatch 403 password\.
 RedirectMatch 403 maincore\.
 RedirectMatch 403 authorize\.
 Redirectmatch 403 macromates\.
 RedirectMatch 403 head\_auth\.
 RedirectMatch 403 submit\_links\.
 RedirectMatch 403 change\_action\.
 Redirectmatch 403 com\_facileforms\/
 RedirectMatch 403 admin\_db\_utilities\.
 RedirectMatch 403 admin\.webring\.docs\.
 Redirectmatch 403 Table\/Latest\/index\.

That’s the juice right there. This 4G Blacklist is some powerful stuff, blocking and filtering a wide range of potential attacks and eliminating tons of malicious nonsense. Much care has been taken to beta test this firewall on multiple configurations running various types of software, however, due to my limited financial resources, it is impossible to test the 4G as comprehensively as I would have preferred. Even so, for the average site running typical software, everything should continue to work perfectly. With that in mind, please read through the remainder of the article before implementing the 4G Blacklist.

Installation and Usage

Before implementing the 4G Blacklist, ensure that you are equipped with the following system requirements:

  • Linux server running Apache
  • Enabled Apache module: mod_alias
  • Enabled Apache module: mod_rewrite
  • Ability to edit your site”s root htaccess file (or)
  • Ability to modify Apache’s server configuration file

With these requirements met, copy and paste the entire 4G Blacklist into either the root HTAccess file or the server configuration file ( httpd.conf ). After uploading, visit your site and check proper loading of as many different types of pages as possible. For example, if you are running a blogging platform (such as WordPress), test different page views (single, archive, category, home, etc.), log into and surf the admin pages (plugins, themes, options, posts, etc.), and also check peripheral elements such as individual images, available downloads, and alternate protocols (FTP, HTTPS, etc.).

While the 4G Blacklist is designed to target only the bad guys, the regular expressions used in the list may interfere with legitimate URL or file access. If the directives in the blacklist are blocking a specific URL, the browsing device will display a 403 Forbidden error; similarily, if the blacklist happens to block a file or resource required for some script to function properly, the script (JavaScript, PHP, etc.) may simply stop working. If you experience either of these scenarios after installing the blacklist, don’t panic! Simply check the blocked URL or file, locate the matching blacklist string, and disable the directive by placing a pound sign ( # ) at the beginning of the associated line. Once the correct line is commented out, the blocked URL should load normally. Also, if you do happen to experience any conflicts involving the 4G Blacklist, please leave a comment or contact me directly.

Set for Stun

As my readers know, I am serious about site security. Nothing gets my juices flowing like the thought of chopping up mindless cracker whores into small, square chunks and feeding their still-twitching flesh to a pack of starving mongrels. That’s good times, but unfortunately there are probably laws against stuff like that. So in the meantime, we take steps to secure our sites using the most effective tools at our disposal. There is no one single magic bullet that will keep the unscrupulous bastards from exploiting and damaging your site, but there are many cumulative steps that may be taken to form a solid security strategy. Within this cumulative context, the 4G Blacklist recognizes and immunizes against a broad array of common attack elements, thereby maximizing resources while providing solid defense against malicious attacks.

Many Thanks

A huge “Thank You” to the dedicated people who helped beta test the 4G Blacklist. Your excellent feedback played an instrumental role in the development of this version. Thank you!

Further Reading

For more insight into the mysterious realms of blacklisting, the creation of the Perishable Press Blacklist, and DIY site security in general, check out some of my other articles:

Next Up

Next up in the March 2009 Blacklist Series: The Ultimate User-Agent Blacklist. Don’t miss it!


Since the release of the 4G Blacklist, several users have discovered issues with the following 4G directives.


In the query-string section, Joomla users should delete the following patterns:


In the character-string section, Joomla users should comment-out or delete the following lines:

RedirectMatch 403 \,
RedirectMatch 403 \;
RedirectMatch 403 config\.
RedirectMatch 403 register\.


In the query-string section of the 4G Blacklist, the following changes have been made:

"%3D" character-string has been changed to "%5C"

Likewise, in the character-string section, the following change has been made:

"wp\_" character-string has been removed

And in the request-method filtering section, the following change has been made:

"HEAD" method has been removed

Also, the following changes may be necessary according to which plugins you have installed:

Ozh' Admin Drop Down Menu - remove "drop" from the query-string rules
WordPress' Akismet - remove "config" from the query-string rules


OpenID users should read the information in this comment.


SMF users should read the information in this comment.


vBulletin users should read the information in these comments.

Jeff Starr
About the Author Jeff Starr = Designer. Developer. Producer. Writer. Editor. Etc.
233 responses
  1. Did I check the updates? Not yet :(

    I did narrow it down to the filtering of the comma in the URL string. If I comment that out, Remository downloads work. However, I detect from your writing that you really don’t like eliminating an entire class of filter, because it then leaves other potential exploits available. That’s why I was supplying the “bad” URL string…which has *two* instances of a comma in it.

    Will check the Joomla updates later this morning. And Greg: thanks again. You provide some wonderful stuff :)

  2. I see Dave Stuttard in comment #75 already picked up this particular issue, albeit it with a different Joomla! component. The comma in a URL does affect Remository in Joomla! 1.5.x, and one way to fix it is to comment out the “RedirectMatch 403 \,” directive.

  3. Dave Stuttard May 8, 2009 @ 4:55 am

    Just a thought – I don’t use Joomla! or WordPress or SMF or vBulletin, etc. My site with the comma in some address strings is a conventional php/MySQL driven dynanic site – the point is that the 4G Blacklist may have been aimed at Joomla! and WordPress scenarios originally but it can also apply to other scenarios like mine.

    General Point
    ‘SpamBlockerUtility’, ScoutJet and maybe others are still getting in so maybe these should be dealt with individually with ‘RewriteCond’s (otherwise one usually has to deny ranges of IPs, not single IPs, possibly blocking some legitimate visitors):

    RewriteCond %{HTTP_USER_AGENT} spamblockerutility [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} scoutjet [NC]
    RewriteRule ^.* – [F,L]

    (note the absense of ^ before the UA element – without it we can ban any UA string that includes that element (somebody correct me please if my code is wrong) and don’t forget the NC to make it case-insensitive.

  4. Chaos Inc. May 9, 2009 @ 12:27 am

    Hiya Jeff!

    Already mailed ya yesterday regarding this but I want to add a little more (a lot more lol) feedback with the ones I already mentioned in the mail. Also, I hope that this will help you and in turn, help us, to generate the ultimate GX (generation X) Blacklist.

    After implementing only your 4g blacklist on my blog:

    My WordPress Auto Thumb Generation plugin (TimThumb) is not working, and it maybe because the auto generated images/thumbs carries some & or % characters/strings.

    Users browsing from all and any kind of mobile platform is being shown the

    Users browsing from Opera mobile, opera mini, and other symbian/iphone
    applications are being blocked. There are two kinds of connection for Opera
    mini : Socket and Http based connections. Neither works. Some mobile phone
    browsers also user shadow connects by default and those are also being

    Both symbian, python and flashlite based browsers are being shown 403.

    I’m a mobile theme and ui developer and people similar to me who actually
    produces content are being scraped severely, suffering stolen content
    dilemmas and other general dos based attacks. Is there a way I can block
    someone/everyone who regularly visits a site like and visiting
    mine as well. What i mean to say is that can i block someone who is probably
    stealing my content and posting in his site? Since there is a usage pattern
    and trend for that visitor like he visits his site first and then visits
    mine to copy and he does this for every post i make. Cant they be blocked
    based on their behaviorat pattern?

    Almost all telecom operators usually provide 3g, gprs or 2.5g based mobile
    internet to all their clients. Typically a mobile user from a country like
    Bangladesh (my country) will have the ip of Norway on his phone because the
    telecom or gsm operator’s mobile internet gateway for all the countries
    they operate in are going through a single wireless internet platform (to be
    cost effective and so on). This platform actually works as a hub for their
    global 3g network in different countries. Is there a way to somehow let
    users enter my site by skipping all the htaccess rules set by me when they
    are from a mobile phone/pda/iphone etc.

    Lastly, almost anyone who have implemented cname records for his WAP or
    Online Store for a subdomain on his site cannot go back to the main
    page/normal-pages when they have visited the store ( otherwise referred by
    the store). This can be because of the weird caniocal url for any content on
    the store/wapsite typically produce (not sure though). Is there a way to let
    users browse my site normally when referred from a specific
    domain/subdomain/platform etc?

    Some mobile phone focused search engine crawlers are being blocked. Like
    those from google mobile or mobile meta tag search. Is there a way to fix
    this and let them in?

  5. Done this today for SMF 2.0 RC1

    RewriteCond %{QUERY_STRING} ^.*((|)||'|"|?|*).* [NC,OR]

    Because with the [|] we can’t erase some messages in the private box of the forum (MP)

  6. Ah yes! Working great! Thanks, man. We all appreciate it.

  7. John Hoff - WpBlogHost May 22, 2009 @ 3:13 pm

    Jeff, this is an excellent list of directives. Thank you for sharing.

    Question. One of the services we provide is hardening people’s WordPress blog. I’d like to include these in our upgrades. Would you be open to letting me paste these directives in to our customer’s .htaccess files? I’d be sure to leave the comment showing your site and anything else you might request.

    Thanks. Stumbling this article and Tweeting it!

  8. Awesome list.

    I will add it in .htaccess file.

    Have on one doubt, Where should i add the above list? after wordpress lines in htaccess file or before?

  9. Garrett W. May 26, 2009 @ 11:11 pm


  10. Jeff Starr

    @John Hoff – WpBlogHost: Thanks for the great feedback — much appreciated.

    As for including the 4G blacklist into your customer’s HTAccess files, contact me directly to discuss further. Thanks.

  11. Douglas Machado May 27, 2009 @ 6:26 pm

    Have you ever tested Apache mod_security?
    Which is the best (most reliable) and faster security solution 4G Blacklist of mod_security?

    ModSecurity website:

  12. Jeff Starr

    @Douglas Machado: Without a doubt mod_security. 4G is designed to thwart specific types of attacks while mod_security is a much more comprehensive security strategy. I am running a modified version of 4G to complement mod_security, not replace it. So, if you have to pick, go with mod_security. Then, if you need additional protection, try the 4G Blacklist. ;)

[ Comments are closed for this post ]