title: Using .htaccess to block referrer spam with wildcard subdomains
body: <p>I have been trying to block some referral spam to our WordPress sites using .htaccess code similar to that shown below.  </p>
  
  <p>This seems to be fairly effective in blocking the primary domains (semalt.com) and explicitly defined subdomains (semalt.semalt.com).  </p>
  
  <p>But, the wildcard subdomains (i.e. 1.semalt.com, 2.semalt.com) seem to be getting past the filters.</p>
  
  <p>Is there anything obviously wrong with this code allowing wildcard subdomains to get through?</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteBase /
  
  # block spammers
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*semalt\.com [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*kambasoft\.com [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*savetubevideo\.com [NC,OR]
  RewriteCond %{HTTP_REFERER} semalt\.semalt\.com [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*seoanalyses\.com [NC]
  RewriteRule .* - [F]
  
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>Also, I have managed to reduce the stream to a trickle, so it is possible the htaccess code is correct, and the spammers are getting around this other ways.  Thanks!</p>