Block request if header exists

# block if request has header HTTP_USER_AGENTT
# e.g. Useful to protect against the PHP "zerodium" backdoor
# https://thehackernews.com/2021/03/phps-git-server-hacked-to-insert-secret.html
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:HTTP_USER_AGENTT} !^$
    RewriteRule ^ - [F]
</IfModule>

# Another approach would be to always unset the header from the request 
# before PHP receives it
<IfModule mod_headers.c>
  RequestHeader unset HTTP_USER_AGENTT early
</IfModule>

# Test: curl -v -I 'https://yourwebsite.com/' -H 'HTTP_USER_AGENTT:anyvalue but could start with zerodium'