Bots subscribing to site--even with subscription URL is blocked in
htaccess
reddit / selfhosted

----------------------------------------------------------------------
chriscasemart · 2023-10-17 20:13

I'm using a self-hosted installation of PHPList to manage a
newsletter.

Subscribers can be added via a POST to this URL:

https://www.\[WEBSITE\]/lists/?p=subscribe

It's presently overrun by bots.

I added this to .htaccess to block this URL

RewriteEngine On

RewriteCond %{QUERY\_STRING} \^p=subscribe$ \[NC\]

RewriteRule \^ - \[F\]

Now, if you visit the subscription page above it will give a 403
error.

But, you can still add subscribers by using a POST to this URL.

How can I actually block folks from using this URL to subscribe?

----------------------------------------------------------------------
redoubledit · 2023-10-17 20:45

Looking through [the API docs](https://github.com/phpList/rest-
api/blob/main/docs/Api/RestApi.apib), shouldn't you have to
authenticate your sessions? Or did you disable this somehow?

----------------------------------------------------------------------
chriscasemart · 2023-10-17 21:14

I have the API disabled. Do you have other ideas I can test? Thanks!

----------------------------------------------------------------------
zoredache · 2023-10-17 21:42

Do you have any access logs on the server? Or can you enable them?
Examine your logs and see what the bots are accessing, then block
that?

----------------------------------------------------------------------
zfa · 2023-10-17 23:40

I know, I know **'BuT It's NOt seLFhOStEd!'** but I just let the pros
deal with bots and front that kind of stuff with Cloudflare.

If you've privacy concerns you can always have that one thing on a
specific subdomain and only enable Cloudflare on that, whilst keeping
the rest of your subdomains unproxied.

Alternatively can't you add a capture (again, giving up a bit of
privacy).

----------------------------------------------------------------------
redoubledit · 2023-10-18 15:46

Well, if you want to use API features, why do you disable the API to
then have to tackle problems that didn't exist before?

Other ideas? Enable API and block that URL you don't want accessed.
Then do API stuff via the API.

----------------------------------------------------------------------
timothyclaypole · 2023-10-19 20:49

This is one of the cases where there’s a real practical advantage to
having a reverse proxy in front of your site/software.  The proxy
could be configured very easily to drop any access to that specific
URL .