.Htaccess protect subdirectory folder

[wll6568]

How can I protect images within a subdirectory so that they cannot be accessed remotely or direct url access? But still be able to be shown on my own web pages?

It's not the Cpanel hotlinking thing, it's different. Anybody knows?

[phranque]

something like this?

RewriteEngine on
RewriteCond %{HTTP_REFERER}!^http(s)?://(www\.)?example.com [NC]
RewriteRule \.(jpg¦jpeg¦png¦gif)$ getyourowndamn.jpg [NC,R,L]

[wll6568]

Tried that, but doesnt seem to be working...

[phranque]

Tried that, but doesnt seem to be working...

if you are still asking for help, that doesn't give us much to go on.
instead of an ellipsis, this is where we should be reading something informative:
- requirements
- execution
- expectation
- results

[jdMorgan]

Yes, we need to know how you tested, what your results were, and how those results differed from your expectations. What did you see in the browser? What do you see in your server access and error logs?

However, here are some recommended tweaks:

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example\.com [NC]
RewriteCond %{REQUEST_URI} !/getyourown.jpg$
RewriteRule \.(jpe?g¦png¦gif)$ getyourown.jpg [NC,R,L]

Replace all broken pipe "¦" characters above with solid pipes before use; Posting on this forum modifies the pipe characters. Completely flush your browser cache after changing any code and before testing, and also after any successful load (for example, from an 'allowed' page on your own site) of the image you are using to test.

Like all HTTP_REFERER-based methods, this is not 100% effective. It cannot protect against direct type-ins, JavaScript image preloads, and requests coming from corporate or ISP caching proxies. For more effective protection, you need to save the images in non-Web-accessible filespace, and force all image requests to go through a script that checks a cookie set by a page or pages on your site to 'authorize' the image access. Alternatively, you could also use a script that renames the images or the image directory periodically.

Generally, HTTP_REFERER anti-hotlinking is acceptably effective if the scripts are simply being hotlinked casually, but not if they are being intentionally stolen. This is because enough hotlinking requests will fail to make the users of the hotlinking site complain to that Webmaster that the image is broken to discourage that webmaster from keeping the image linked.

Jim