This is some of the stuff I have in some of my .htaccess files (I block a lot of things):
## turn on the rewrite engine
RewriteEngine on
## check for things we deny outright
RewriteCond %{HTTP_USER_AGENT} (dts.agent|obot\/2\.3\.1|ip\-web\-crawler|ahrefsbot|intelium_bot|exabot|xpymep|935\.ibm\.com|sosospider|sitebot|tencenttraveler|cmsworldmap|snookbot|aihitbot|whitehat|turnitinbot|dotnetdotcom|panscient|toata.dragostea.mea.pentru) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (careerbot|mj12bot|youdaobot|sogou|jikespider|businessdbbot|automattic\sanalytics|mj12bot|/bot\.php|ccbot|commoncrawl|zmeubot\-mysql|twengabot|webdav|netcraftsurveyagent|baiduspider|yandex|nmap.scripting.engine|gootkit.auto.rooter.scanner) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(morfeus|java|betaBot|libwww.perl|libcurl|curl|microsoft.url.control|imagelock.com|cyveillance.com|discoveryengine.com|adnormcrawler|www.adnorm.com) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (DigExt|SWEBot|Gootkit|auto\-rooter|webcollage|Microsoft.Data.Access.Internet.Publishing.Provider.DAV) [NC,OR]
RewriteCond %{THE_REQUEST} (CHANGELOG\.TXT|ISC\.SANS\.DFind|/NULL|/README|JUNKMETHOD|_SERVER\[DOCUMENT_ROOT\]|_PHPLIB\[libdir\]|_SERVER\[ConfigFile\]|_REQUEST\[option\]) [OR]
RewriteCond %{THE_REQUEST} (/bin/|login\.cgi|\.asp|/index\.jspa|/user|/ads|/xml|/blog|/fast|/include|/cart|/php/|/cmd.php|/etc/passwd|/tmpr) [NC,OR]
RewriteCond %{THE_REQUEST} (/motherofgod|/terms.conditions|/refund|/product_info|/moneyback|\.wantsfly|/prx\.php|/prx1\.php|/prx2\.php|/mysql|/libraries|/pma|/_pma|/__pma|/_phpmy|/__phpmy|/phpmy/|/phpmyadmin[^\.]|/phppgadmin|/phpmyadmin/|/phpmyadmin\-|/php\-my|/phpmy\-|/phpmyadmin\.\d|/p/m/a|/php\-my\-admin) [NC,OR]
RewriteCond %{THE_REQUEST} (//default.css|/htdocs/|/ldap/|/pla/|\+\+\+\+\+\+\+\+\+\+\+|/headers|slurpconfirm404|/crossdomain\.xml|/c99|/r57|/hord|/misc|Notify_Uncategorized_Allowed|/usage|notifyuser|/get_orders_list|/db_adodb.php|/send_reminders\.php|/calendar\.php|/config_settings\.php|/myadmin|/padmin|/webad|/webdb|/websql|/proxy|/program) [NC,OR]
RewriteCond %{THE_REQUEST} (/tooltip\.js|/t3lib|/htmlarea|/xoops|/ecrire|/own\.php|/openldap|/ldapadmin|/level|/install\.txt|/shared/[^a-z]|/vb|/old|/upload\.php|\.\.\/\.\.\/|/saveserver\.php|/intranet|/joomla|/cms|/admin|/db/|/homework|/bbs|/dbadmin|/dbmyadmin|/mspgmysql|/phpadmin|/myadmin/|/phpmya|phpmpa|/2phpmy|/phppma|/qql|/admm|/admn) [NC,OR]
RewriteCond %{THE_REQUEST} (/cobbler|/CFIDE|/traq|/gameframe\.net|/shell\.php|/devicedesc|/igd|/upnp|/phpldap|/ajaxfilemanager|/ccbill|/ivms|/flow\.php|/jmx\-console|/phpbb|/smf|/yellowfish|/\(null\)|/sched|/phpsched|/datenbank|/database|/moodle|/signup\.|/xampp|/typo|/zen|/shop|/install/|/store|/news|/list|/manager|/phplist|/script|/sql[^\.]) [NC,OR]
RewriteCond %{THE_REQUEST} (/trackback|/ipb|/error10\.php|/\.bash_history|/v2/|/nice.ports|\+and|\+or|\+union|\+select|/progotte|SVH\-CoachingPage|/3rdparty|/rahat|/spaw|/nosuichfile|/noxdir|/nuke|MM_preloadImages|/cgi|/ttx\.cgi|/wp\-login\.php|/wordtrans|/appserv|/amazon|/sumthin|/phpmanager|/riau-online|/web/|/phpmyfaq|/appconf\.htm) [NC,OR]
RewriteCond %{THE_REQUEST} (/vtigercrm|/x\.zip|/cache|/viewpart|/ShowUrl|/ShowForum|allow_url_include|/index\-9x\.jsp|/apps|/phpAlbum|/sitecore|/umbraco|/trix|/soapCaller|/checkproxy|/sd/|/wiki|/tiki|/rules\.abe|/thisdoesnotexistahaha\.php|/proxyjudge|/people|/function|/_vti_bin|/azenv|/email|/mail(?!to)|/newmail|/awstats|/stat|/cgi\-bin) [NC,OR]
RewriteCond %{THE_REQUEST} (/application$|/application\.ini|/configs|FHSCAN|/www\.fbi\.gov|/wordpress|/system|/loja|/phpdb|/extern_js|/phpldap|muieblackcat|/recordings|/cisco|/ticker|mbisetup|/autoconfig|/mural|/wm/|/rc/|/round|/cube|/a1b2c3d4|/adxmlrpc\.php|/portal|/cacti|/stats|/db/|/web|/fastenv|/store|/phpads|/xml|/drupal|/community|myproxylists|http_write) [NC,OR]
RewriteCond %{THE_REQUEST} (/SSLMySQLAdmin|/sprawdza|/tabcontent|/tengo|/autoupdate|/prefConf|/a2bill|/foro|vicidial|html\+http|/google|/vhosts|/ehcp|/translat|/main\.php|passthru|/pmwiki|/V20x|/123flash|/4images|/\=http|/assets/|/class/|/libs/|/lib/|/components|/content/|/gallery/|/global|/module|/phpthumb|/wp\-content|/wp\-admin|/mya) [NC,OR]
RewriteCond %{THE_REQUEST} (/w00tw00t|trafficbasedsspsitemap\.xml|scanproxy|/wp\-trackback|/anony/|/engine/|/project_auth|/phpinfo|dompdf|fckeditor|fck/editor|blackhats|/impex|/forum|/imghp|/buysellads|/template|/e107|/ant\.dsabuse\.com|/arcade\.php|/shop/|/backoffice|/comersus/|/oscommerce/|/store/|/catalog/|/products/|/extras/|/cpa|/sl2) [NC,OR]
RewriteCond %{THE_REQUEST} (/feed|/external|/rss) [NC,OR]
RewriteCond %{THE_REQUEST} (/x[0-9a-f][0-9a-f].?/x[0-9a-f][0-9a-f]) [NC,OR]
RewriteCond %{QUERY_STRING} (phpinfo|\.\.\/) [NC]
## deny access
RewriteRule ^.*$ - [F,L]
## check for attempt to access included files directly if there is no referrer the site
## indicate the directories to check for
RewriteCond %{THE_REQUEST} (/tmp/|/local/|/shared/|/demos/stuff/|/images/) [NC]
## the referrer is blank
RewriteCond %{HTTP_REFERER} ^$ [NC]
## deny access
RewriteRule ^.*$ - [F,L]
## indicate the directories to check for
RewriteCond %{THE_REQUEST} (/tmp/|/local/|/shared//|/demos/stuff/|/images/) [NC]
## the referrer is NOT blank
RewriteCond %{HTTP_REFERER} !^$ [NC]
## the referrer MUST be from your domain
RewriteCond %{HTTP_REFERER} !^https*://(www.)*yourdomain.com [NC]
## deny access
RewriteRule ^.*$ - [F,L]
## this rule is the one that I think would work to block anyone from going after app pages that are for use by your app only
RewriteCond %{THE_REQUEST} /yourgamedir [NC]
## the referrer is NOT blank
RewriteCond %{HTTP_REFERER} !^$ [NC]
## the referrer MUST be from your domain
RewriteCond %{HTTP_REFERER} !(Your%20App%20Name|^InternetConnection$) [NC]
## deny access
RewriteRule ^.*$ - [F,L]
Now some of the stuff I am blocking is because I know what exists on all of the domains I host and none of them have blogs or cms systems.
You should be careful about what you put in, or you might block things you don't want to.
The last RewriteCond/RewriteRule set is the one I was mentioning.
Cheers,
Ancient Lady
AGK Community Tester and AppGameKit Master