How to block TOR exit nodes from accessing your website on Apache and Nginx

If you ever want to block TOR users from your accessing website completely or block them from accessing specific file(s) / location(s) only for any reasons you may have and you’re running Nginx or Apache, hopefully this post can help you with that.

First thing first, the command used here for both Apache and Nginx were designed to be use in cron because TOR ip often change. But make sure that it’s scheduled for 1 hour at minimum to respect those that gives you free service to lookup tor ip =)

Getting a list of TOR IP Addresses

Before anything else we need to get a list of TOR IP Address, and to do that we have two options (but of course feel free to use your own source if you have one):

  • Use TOR Bulk Exit List from Torproject
  • Use an external sites that list TOR IP Address such as from

Note: website only allow you to fetch it every 1 hour only (even if you accidentally clicked it), i choose to not link to the ip address url directly because of that reason and so you have to copy the url directly

How to remove index files from URL on Nginx

So yesterday while i was idling on Freenode i saw someone asking in Nginx channel that he basically wants to remove the index.php file from the url or in other words he wants to redirect into … probably for canonicalization purpose (canonical url) and/or perhaps SEO purpose. He had tried this:

# And it causes redirect loop (also tested on my local box)
# Atlhough it works fine for simple php files but not on his vBulletin setup
# or other non simple php file (because i don't have access to vBulletin i tested it on other script)
# Note the | is for illustration
location =|~ /index.php {
	rewrite ^|/ permanent;

And being curious, i tried some testing to remove that index.php thing from the URL and found a way to do it and it was simple. So if you’re currently looking for a way to remove or redirect your index file from the URL and you’re using Nginx perhaps this simple tips can help you with that

First thing first is open your nginx configuration files that hold your virtual hosts configuration and then add this line inside the server directive: