while you are in htaccess better change this:
Code: Select all
RewriteCond %{REQUEST_URI} !.*\.(ico|gif|jpg|jpeg|png|js|css)
to this:
Code: Select all
RewriteCond %{REQUEST_URI} !.*\.(env|ashx|cfg|dat|ico|cur|txt|mp3|webp|svg|ttf|eot|woff|woff2|gif|jpg|JPG|jpeg|JPEG|png|js|cfg|css|pdf|zip|env|tar|sql|gz|tar|exe|rar|arj|cab|iso|rpm|tbz|tgz|old|bak|backup|dump|db|7z|asp|aspx|exp|html|htm)$
you see, what this:
Code: Select all
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !.*\.(ico|gif|jpg|jpeg|png|js|css)
RewriteRule ^([^?]*) index.php?_route_=$1 [L,QSA]
does is when a requested resource does not exist in your file-system (i.e. seo urls), the request is passed as a get parameter to index.php.
But only if it is not a request for a static asset like ico, gif, etc.
This in the assumption that it must be an seo url so it is handled by the seo_url class which queries the database to find get variables for the keywords in that seo url.
but, there are a lot of bots out there which will request many more asset types from your site to see if they can obtain vital data.
requests for database.bak, xxx.zip, yy.dat, etc.
Those files, I assume and hope, you also do not have in your file-system open to the internet.
This means that each of those requests will also trigger a database query, and a subsequent creation of a nice 404 not found page, for nothing.
And make no mistake, those requests will come at 100+ per second.
Our production site uses this:
Code: Select all
RewriteCond %{REQUEST_URI} !.*\..*$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^?]*) /co/index.php?_route_=$1 [L,QSA]
which means requests for assets not found in our file-system will be passed to index.php but only if the requested url does not contain a dot.
Meaning all xxxx.xxx requests, covering all.
Of course, this means we cannot use a dot in our seo urls.
but all those requests for x.zip and yyy.bak will be blocked with a 404 at web server level, not even invoking php.