Rewrite rule in .htaccess that blocks all connections with specific Query String value

Question

I've tried a few variations, but can anyone help me out with a rewrite rule in a .htaccess that would block all connections where a query string value of x=y.

/app/index.php?x=y

Answer 1

To match the query string you need to use a condition that checks the QUERY_STRING server variable. The RewriteRule pattern matches against the URL-path only.

So, to block (403 Forbidden) any request that contains a query string of x=y with mod_rewrite, you would do something like:

RewriteEngine On

RewriteCond %{QUERY_STRING} ^x=y$
RewriteRule ^ - [F]

The regex ^ matches anything. The hyphen (-) in the substitution is a placeholder for no substitution.