apache, nginx: ограничение видов запросов

В apache через .htaccess, Limit и LimitExcept

Например

Only one Order directive per .htaccess file -- The last one overrides the previous ones.<br /> Similarly, any conflict between <limit> containers will result in the last one that applies being used.<br /> <br /> There is no need to enclose the Deny from's in a <limit> container, so I'm not sure why you're doing that. For example, PUTs and DELETEs will be allowed from your listed IP addresses with the code as-posted.<br /> <br /> Also, see <limitexcept>, which may be useful to you.<br /> <br /> I'd suggest:<br /> <br /> # Allow all to fetch robots.txt and custom 403 error page<br /> SetEnvIf Request_URI "^/(robots\.txt¦my_custom_403_page\.html)$" allow-it<br /> #<br /> Order Deny,Allow<br /> #<br /> # Allow all to fetch robots.txt and custom 403 error page<br /> <limit GET><br /> Allow from env=allow-it<br /> </Limit><br /> #<br /> # Deny all methods except for GET, HEAD, and POST (HEAD is implied by GET -- see documentation)<br /> <limitexcept GET POST><br /> Deny from all<br /> </LimitExcept><br /> #<br /> # Deny from various country's IP address ranges<br /> Deny from 41.204.224.0/19<br /> Deny from 41.205.160.0/19<br /> ...<br /> Deny from 213.166.160.0/19<br /> Deny from 213.181.64.0/19<br /> <br /> Replace the broken pipe character in the SetEnvIf directive above with a solid pipe character before use; Posting on this forum modifies the pipe characters.

http://www.webmasterworld.com/apache/3537686.htm
http://board.phpbuilder.com/showthread.php?10367096-.htaccess-configuration-(limit-get-allow-deny)-and-lt-Limit-GET-HEAD-POST-gt

nginx
синтаксис: limit_except метод ... { ... }
контекст: location
Ограничивает HTTP-методы, доступные внутри location. Параметр метод может быть одним из GET, HEAD, POST, PUT, DELETE, MKCOL, COPY, MOVE, OPTIONS, PROPFIND, PROPPATCH, LOCK, UNLOCK или PATCH. Если разрешён метод GET, то метод HEAD также будет разрешён. Доступ к остальным методам может быть ограничен при помощи директив модулей ngx_http_access_module и ngx_http_auth_basic_module:

limit_except GET {
    allow 192.168.1.0/32;
    deny  all;
}
Обратите внимание, что данное ограничение действует для всех методов, кроме GET и HEAD.
http://nginx.org/ru/docs/http/ngx_http_core_module.html