Apache HTTP Server

Report probes and injection attempts from Apache logs, and deny listed addresses.

The same scanner traffic that hits nginx hits Apache. Report it from the access log, and deny listed addresses with a generated Require block.

Report scanners

The log lives at /var/log/apache2/access.log on Debian and Ubuntu, and /var/log/httpd/access_log on RHEL. Remove any path your site really uses.

grep -E '"(GET|POST|HEAD) /+(\.env|\.git/|wp-login\.php|xmlrpc\.php|phpmyadmin|vendor/phpunit|cgi-bin/)' /var/log/apache2/access.log | awk '{print $1}' | sort -u | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=web-app-attack,vuln-scan -d comment="apache: probing for .env/.git/phpmyadmin"

Report injection attempts

grep -iE 'union(%20|\+| )select|information_schema|\$\{jndi:|/etc/passwd' /var/log/apache2/access.log | awk '{print $1}' | sort -u | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=sql-injection,rce,web-app-attack

Deny listed addresses

1. Fetch the list as Apache 2.4 rules, hourly:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=apache" -o /etc/apache2/isipsafe.conf && apachectl configtest && apachectl graceful

2. Include it where access is decided, for example inside a <Directory> or <Location /> block:

   <Location "/">
       Include /etc/apache2/isipsafe.conf
   </Location>

The generated file is a <RequireAll> block, so it combines safely with your other access rules. Behind a proxy, enable mod_remoteip first so Apache sees real client addresses.

Need a hand?

If something here does not work with your version of Apache HTTP Server, or you have improved it, tell us. We update these pages with what people send.

Apache HTTP Server and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.