Alden Bates' Weblog

Mod_rewrite is a great tool in Apache for doing fancy stuff with URLs and redirections and blocking spammers. That said, while using it you should remember that the conditions and rules you add are checked by Apache on every single hit, be it for an HTML file, an image, or a style-sheet. So, here are some suggestions for reducing the amount of work Apache does for each hit:

1. Use string matches in preference to regular expressions

String comparison is faster than evaluating regular expressions, so where possible, use them in preference. For example, in detecting that a user has a particular IP address, I was previously using something like:

RewriteCond %{REMOTE_ADDR} ^127\.0\.0\.1$

This would be a faster check as:

RewriteCond %{REMOTE_ADDR} =127.0.0.1

2. Short-circuiting conditions

If you have a sequence of RewriteCond statements and the first RewriteCond evaluates as false for a particular hit, then mod_rewrite will skip to the next rule without evaluating any more conditions.

RewriteCond %{REQUEST_URI} ^/g/(.*)
RewriteCond %{HTTP_REFERER} =http://www.somedomain.pleng/
RewriteRule .* arudepicture.jpg [R=permanent,L]

Let's say I have a directory named "g" in which exists some images someone on a message board on somedomain.pleng has linked to. This rule redirects the hits to an unpleasant picture to encourage them to remove the remote linking. The first condition is true every time someone hits a file in the "g" directory, including if they're following links from my own pages, while the second condition is true only when the hit comes from anotherdomain.com. Therefore by switching the two conditions around:

RewriteCond %{HTTP_REFERER} =http://www.somedomain.pleng/
RewriteCond %{REQUEST_URI} ^/g/(.*)
RewriteRule .* arudepicture.jpg [R=permanent,L]

Now the second condition is only evaluated when the hit comes from the other site, and the referrer test is a string comparison, so faster to evaluate.

For a sequence of [OR] conditions, the logic is reversed and if the first condition evaluates to true then the rest of the conditions are skipped. Here are some rules I have for handing referrer spammers a 403 error:

RewriteCond %{REQUEST_URI} =/
RewriteCond %{HTTP_REFERER} (casino|poker|holdem) [OR]
RewriteCond %{HTTP_REFERER} (creditfinance|debt) [OR]
RewriteCond %{HTTP_REFERER} (pills|drugs|pharmacy)
RewriteRule .* - [F,L]

Note that [OR] has a higher precedence, so this will be evaluated as (line 1 AND (line 2 OR line 3 OR line 4)), but the lines are still evaluated in order so it will only reach line 2 if the hit is on http://www.aldenbates.com/ and not for other files on my site. If they're referrer spamming a site with casino in the URL, line 2 will be true and mod_rewrite will skip to the next "AND" RewriteCond or (as in this case) the RewriteRule. Thus if I begin to get more spam for drug sites I can move the lines around to test for drug keywords first.

RewriteCond %{REQUEST_URI} =/
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} (pills|drugs|pharmacy) [OR]
RewriteCond %{HTTP_REFERER} (casino|poker|holdem) [OR]
RewriteCond %{HTTP_REFERER} (credit|finance|debt)
RewriteRule .* - [F,L]

Additionally, adding an "AND" rule to the start means that if someone hits the index page with no referrer, mod_rewrite skips testing the referrer altogether and ends up only evaluating the first two lines rather than the whole lot. Other common but legit referrers like Google could be added in too.

To come: Part 2