How to prevent a Web site from being accessed by a malicious reverse proxy

  Recently someone used the station data, using reverse proxy technology, made a thief station. The user is visiting his web site, but essentially the content data is mine, this is a malicious reverse proxy event

What is a reverse proxy?     First, the concept of forward agent:    forward agent, the legendary agent, he works like a springboard. To put it simply, I'm a user, I can't access a website, but I can access a proxy server. This proxy server, he can access that I can not visit the site, so I first connected to the proxy server, told him I need that can not access the content of the site, proxy server to fetch back, and then return to me. From the point of view of the website, only when the proxy server to pick up the content of a record, sometimes do not know is the user's request, but also hides the user's data, depending on the agent does not tell the site.     The conclusion is that the forward proxy is a server between the client and the original server (Origin server), in order to get content from the original server, the client sends a request to the agent and specifies the target (the original server). The agent then forwards the request to the original server and returns the obtained content to the client. The client must make some special settings to use the forward proxy.     So the concept of reverse agent?     such as user access to Http://www.nowamagic.net/librarys/veda this page, But www.nowamagic.net actually does not exist on this page, he was secretly taken back from another server, and then spit it out to the user as his content.     But users do not know, this is normal, users are generally very stupid. The www.nowamagic.net this domain name corresponds to the server that sets up the reverse proxy function.     Conclusion is that reverse proxy is the opposite, for the client it is like the original server, and the client does not need to make any special settings. The client sends a normal request to the contents of the reverse proxy's namespace (name-space), and then the reverse proxy determines where (the original server) forwards the request and returns the obtained content to the client as if it were its own.     The harm of malicious reverse agent     site by a malicious reverse proxy what harm? Here is a list of:    will certainly occupy server resources first, the speed of Web site opening is affected.   Second, other people through the agent to steal your website data, for users and not so intelligent search engine, the equivalent of a site that is the same as you, then very likely your site will go into the search engine sandbox, or even down the right.   If the malicious proxy page, still hangs your affiliate advertisement (for example AdseNSE), this is very dangerous, if someone clicked on the above ads, it is easy to be AdSense sealed number.   also has many harms, the reader may own brain to fill ...     JS-level solution code is as follows: <script type= "Text/javascript" > if (document.domain!= ' now Amagic.net ' && document.domain!= ' www.nowamagic.net ') { window.location.href= ' http:// www.nowamagic.net/'; The </script>     script is simple, if the URL in the address bar is not nowamagic.net and www.nowamagic.net, then turn the address bar to http:// www.nowamagic.net/. This code also avoids the use of reverse proxy technology to "forge" a website that is exactly the same as yourself.   digression: How to prevent web sites from being embedded in IFRAME. Some people use the IFRAME to make a frame, embed our website, the visitor comes to browse, as if is browsing his own website, so how to solve? The following methods can be broken:     code is as follows: <script type= "Text/javascript" > <!--if (top.location!= self.location) top.location =self.location; --> </script>     PHP-level solutions   JS-level solutions allow malicious proxy pages to bounce back, but are not very friendly to search engines. The following is a server-side (PHP) solution, the code is relatively simple, do not say more.     Code as follows: $proxy _rs = $this-> proxy_filter (); if ($proxy _rs!= ' nowamagic.net ' | | | $proxy _rs!= ' www.nowamagic.net ')   { echo ' illegal reverse proxy access ';  //header (' Loca Tion:http://www.nowamagic.net/');  exit; }   Public Function Proxy_filter () { /*   $SVRURL = ' http://'. $_server[' server_name '].$_server[' php_self "];  if (!empty ($_server["query_string"))  {  $svrUrl. = "?". $_server["Query_string"]; &NBSP}    return $svrUrl;  */ return $_server[' server_name '];     htaccess-level solutions  . htaccess   Code as follows: Rewriteengine on Rewritebase/php_value auto_append_file p roxy.php     proxy.php   code is as follows: <?php $f = getenv ("Http_x_forwarded_for"); $server = getenv ("Http_host"); if (($f!= "") && ($server!= "Nowamagic.net") && ($server!= "Www.nowamagic.net")) { echo ' This server prohibits malicious reverse proxy! '; ?>     This is not tested because of the particularity of my website, but this method is commonly used on the Internet.   Apache httpd.conf-level solutions This Apache how to forbid I haven't figured out, Nginx can, but I use Apache, if you know, please tell me next ~