How to block post method on some url in htaccess

Question

Is it possible to block POST method on some url like

www.mydomain.com/dontposthere
www.mydomain.com/something/againdontposthere

in htaccess ?

Americano

I don't know if this is what you're looking for, but try: #11584601 – Ideography

Answer 1

If you have access to mod_rewrite, you can check the REQUEST_METHOD environment variable and rewrite the url to another page that displays a message saying something like "You are not allowed to post"

Create a page with the message: /var/www/noPost.php

You are not allowed to post to this page

Then use an .htaccess rule like this:

RewriteEngine On

RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^/dontposthere [OR]
RewriteCond %{REQUEST_URI} ^/something/againdontposthere
RewriteRule .* /noPost.php [L,QSA]

You can create a list of files/folders as conditions to match or even a regex pattern to match multiple files/folders. You would just need to put [OR] after all but the last.

Hugely

Answer 2

Alternative to writing a "noPost" page, simply return a 403 response directly with the F|forbidden flag:

RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^/dontposthere
RewriteRule .* - [F,L]

Underpants

Answer 3

Allow POST requests only from specific URI's

You can block POST methods from all URIs, except a few specific ones allowed (like contact forms, and login froms), using this .htaccess code:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} !^/admin/
RewriteCond %{REQUEST_URI} !^/contact\.php
RewriteCond %{REQUEST_URI} !^/login\.php
RewriteRule ^ / [F]    

Hope it's been useful for you, and saves you a few hours.

Loquitur