Forum Moderators: phranque
This is the code I tried in my .htaccess file and I know mod_rewrite is enabled on my server because I checked with phpinfo.
RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?websiteurl.net(/)?.*$ [NC]
RewriteRule .*\.(gif¦jpg¦jpeg¦bmp)$ - [F,NC]
[edited by: Amanda at 6:58 am (utc) on Aug. 3, 2006]
RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?websiteurl\.net [NC]
RewriteRule \.(gif¦jpe?g¦bmp)$ - [NC,F]
In both your original code and this cleaned-up version, the first RewriteCond *allows* access using a blank HTTP_REFERER header. This is necessary in order to prevent blocking legitimate visitors who visit your site through a corporate or ISP caching proxy or those who are running "Internet Security" software, which is blocking transmission of the referer header - most often without their knowledge.
As a result, hotlink control using HTTP_REFERER is only effective enough to stop most cases -- and it makes the hotlinking site look broken, so sometimes the hotlinks get removed. However, it cannot and will not stop hotlinking completely, and you;ll need a more-sophisticated solution if you really need to do that.
You may also want to try a simple test to make sure mod_rewrite is actually *working* -- something like this:
RewriteRule ^test_mrw\.html$ /path_to_a_page_that_exists.html [L]
This search [google.com] wlll lead you to much more information.
Jim
If you see few or no logged image requests from your testing session, then your browser, network, or ISP is caching those images, and therefore they aren't being requested from your server, so your code can have no effect.
And finally, if you see no referrer in the logged accesses, then your browser, internet security softwre, or a network caching proxy is blocking the referrer, so again your code won't act.
Again, referrer-based anti-hotlinking is only an easy partial solution, so don't expect it to be 100%. However, if your browser sends a referrer from the hotlinking page, and it actually gets to your server, and your code is working, then the access will be blocked. You will have to repeatedly flush your browser cache (or disable it) during testing; Once that image is loaded and cached, it will appear for all subsequent requests until you flush it out again.
Jim
Is there any way to just block certain sites from hotlinking?
[edited by: Amanda at 4:07 am (utc) on Aug. 4, 2006]
You can easily change the code to block certain sites, again if a referrer header is sent, but if the code above won't work, then any variation of it is also unlikely to work.
So, then you're back to troubleshooting, and you'll need to look at the log files... Back to square one.
How big is this 'unopenable' log file, what program are you trying to open it with, and what format is it in?
Jim
Jim
I don't know what to tell you, since your efforts to debug this problem are defeated by lack of sufficient tools.
Something's just not right, but I can't figure out what it is without more information, and you can't get that information because the logs are too big (and maybe in a strange format as well).
However, by your request, the following code can be used to block *specific external sites* from hotlinking:
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http://(www\.)?bad_site\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?another_bad_site\.co\.uk [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?last_bad_site\.net [[b]NC[/b]]
# Critical note: No [OR] allowed on last rewritecond before rewriterule!
RewriteRule \.(gif¦jpe?g¦bmp)$ - [NC,F]
This code blocks requests referred by specific sites, whereas the previously-posted code blocks requests referred by any site *except* your own. This code suffers the same shortcoming as the previous -- It can do nothing to help you if the HTTP referer header is blank.
If this code works and the previous code doesn't, that indicates a serious problem with your Apache server installation or with the regular-expressions library installed with your OS.
Jim
Notepad may choke on your log file, try something like Editplus [editplus.com].
I tested the mod_rewrite like you said and it worked, but the hotlink protection doesn't. I used the code you posted and it still didn't work, I can see the images that are being hotlinked.
Just a wild guess, but are you testing it by re-visiting the same pages (with hotlinks) that you were looking at before? In that case, the hotlinked images are in your browser's cache so your browser doesn't even need to get them from the server. Try clearing your browser cache.
