Prevent Hotlinking?

[michaelmcguk]

Hi,

I’d like to prevent image hotlinking on my website.

I’m using the following code:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\\.)?domain.co.uk(/)?.*$     [NC]
RewriteRule .*\\.(gif|jpg|jpeg|bmp)$ - [F,NC]

replacing ‘domain’ with the correct value.

Is this the correct way of hotlinking as it doesn’t seem to prevent it on my site

Thanks for your help

[dklynn]

@michaelmcguk

Hi,

I’d like to prevent image hotlinking on my website.

I’m using the following code:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\\.)?domain.co.uk(/)?.*$     [NC]
[indent]Overkill - you DON'T need either the start anchor or the end anchor (unless you want to restrict a specific image to a specific page) so try

RewriteCond %{HTTP_REFERER} !(www\\.)?domain.co.uk(/)?[/indent]
RewriteRule .*\\.(gif|jpg|jpeg|bmp)$ - [F,NC]
[indent]Overkill - you DON'T need the start anchor so try

RewriteRule \\.(gif|jpe?g|png|bmp)$ - [NC,F]

No Case in a RewriteRule?  Seriously?  Do you use capital letters in your filenames?  If not, remember that NC is ESSENTIAL when matching {HTTP_HOST} but Apache servers ARE case sensitive in terms of path and filename so this is rarely a flag to use in a RewriteRule.[/indent]

replacing ‘domain’ with the correct value.

Is this the correct way of hotlinking as it doesn’t seem to prevent it on my site

Close enough for government work (with the few comments above).

Thanks for your help

Regards,

DK

[michaelmcguk]

Super apologies for the delay.

So I’m right in thinking:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !(www\\.)?domain.co.uk(/)?
RewriteRule .*\\.(gif|jpg|jpeg|bmp)$ - [F,NC]

would do the job fine?

Thanks again

[dklynn]

Michael,

Close enough for government work (because the {HTTP_REFERER} is notoriously unreliable). Your code says:

If the referrer is not empty AND

If the referrer is not (your domain with optional www) AND

If the file extension is (in the list), FAIL the request.

Question: WHY the NC flag in the RewriteRule? Have you mixed the capitalization of your file extensions? If not, get rid of the No Case flag as it’s not necessary.

Regards,

DK