How to Block Bots from Apache with WHM/cPanel

You can block malicious bots from Apache with WHM by using either ModSecurity or by manually editing the Apache configuration file. ModSecurity is a web application firewall that provides a robust way to block bots based on predefined or custom rules. Manually editing the configuration file is a more direct approach for blocking specific bot user agents globally.

Method 1: Using ModSecurity

ModSecurity is a powerful web application firewall (WAF) included with WHM that can analyze and block suspicious traffic, including bad bots.

1. Log in to WHM.
2. Navigate to the Security Center section and select ModSecurity Configuration.
3. Ensure that ModSecurity is enabled. You can use pre-defined rule sets (ModSecurity Vendors) or create your own custom rules.
4. To create a custom rule, go to ModSecurity Tools and then Add a new custom ModSecurity™ rule.
5. Paste a rule similar to the following to block specific bots based on their user agent string:
   Apache

   SecRule REQUEST_HEADERS:User-Agent "@rx (?:BadBot1|BadBot2|AnotherBadBot)" "msg:'Spiderbot blocked',phase:1,log,id:7777771,t:none,block,status:403"
   

6. Replace BadBot1, BadBot2, etc., with the user agent strings of the bots you want to block.
7. Check the boxes to Enable Rule and Deploy and Restart Apache, then click Save.

Method 2: Editing the Apache Configuration File

This method involves adding a custom configuration block to Apache that checks for specific user agent strings and denies access.

1. Log in to WHM.
2. In the WHM search bar, navigate to Service Configuration and then Apache Configuration.
3. Click on Include Editor and then select “Pre Main Include”.
4. From the dropdown list, select “All Versions”.
5. In the text box, paste the following code, customizing the list of bots you want to block:
   Apache

   <Directory "/home">
   SetEnvIfNoCase User-Agent "MJ12bot" bad_bots
   SetEnvIfNoCase User-Agent "AhrefsBot" bad_bots
   SetEnvIfNoCase User-Agent "SemrushBot" bad_bots
   <RequireAll>
   Require all granted
   Require not env bad_bots
   </RequireAll>
   </Directory>
   

6. The /home directory is the default for cPanel servers. You can add more bots to the SetEnvIfNoCase lines using the same format.
7. Click the Update button to save the changes and then restart Apache.