Take the 2-minute tour ×

I have been looking around and trying to work out the best way to protect a few websites of mine.

Appart from the obvious manual monitoring of the site logs and banning extreme/suspicious activity. I have seen many posts etc. about banning user agents. Is this a good route to go down? and would it be a better idea too, instead off banning known bad user agents, just allowing the common mainstream ones such as IE, FireFox, Safari and Chrome?


share|improve this question

closed as off topic by John Gardeniers, womble, Khaled, mdpc, Scott Pack Oct 24 '12 at 20:11


What are you looking to protect from? –  Shane Madden Apr 20 '12 at 0:52

1 Answer 1

up vote 5 down vote accepted

Not worth it.

The User Agent is sent by the client, and is trivial to forge. There's a Firefox add-on that adds alternate UA options to the menu, for example. If the attacker is writing a script, he can specify whatever UA he wants.

share|improve this answer
Indeed, most site suckers give you a list of UAs to impersonate, just so the web server thinks it's dealing with a regular browser. –  John Gardeniers Apr 20 '12 at 3:21
