Expression writing to block across certain subdomains only

Hi, I've got multiple examples of paths or file types I want to block across a mix of main domain and subdomains. For example, I want to block .php completely on the main domain and two subdomains, but allow them on several more. Tried something like this:

(http.request.uri.path contains ".php" and (( eq "primary domain") or ( eq "www.primary domain") or ( eq "subdomain"))

Results in a "not a valid value for expression because the expression is invalid: Filter parsing error (1:149): (http.request.uri.path contains ".php" and (( eq "primary domain") or ( eq "www.primary domain") or ( eq "subdomain")) ^ expected literal ")" (Code: 20127) 

Any samples of the approach above that would work? I have been reviewing operators ruleset engine, and 

( matches "^(www|store|blog)\" and http.request.uri.path contains ".php")...but how would I work 'primary domain' in there as also a hostname to execute on?

Thanks! matches "^(www|subdomain)\.maindomain" and http.request.uri.path contains ".php"

is working, minus for the naked maindomain. How would I go about working the maindomain into the above expression?

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.