deny from host host ...
directory, .htaccess

The deny from directive controls access by host. The argument host can be one of the following:

all

All hosts are denied access.

A (partial) domain name

All hosts whose names match or end in this string are denied access.

A full IP address

The first one to three bytes of an IP address are denied access, for subnet restriction.

A network/netmask pair

Network a.b.c.d and netmask w.x.y.z are denied access, to give finer-grained subnet control. For instance, 10.1.0.0/255.255.0.0.

A network CIDR specification

The netmask consists of nnn high-order 1-bits. For instance, 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0.

deny from env=variablename ...

directory, .htaccess

The deny from env directive controls access by the existence of a named environment variable. For instance:

BrowserMatch ^BadRobot/0.9 go_away
<Directory /docroot>
order allow,deny
allow from all
deny from env=go_away
</Directory>

Access by a browser called BadRobot v0.9 sets an environment variable go_away, which in turn triggers deny from.