htaccess hotlinking problem

Problem with exceptions for hotlinking in htaccess

[slshimerdla]

Alright, so this is starting to drive me nuts, and I figure it must be something simple I'm missing that someone else can catch. Here's my htaccess file, on a wordpress site:

ErrorDocument 404 /404.shtml
Options All -Indexes

<Files 403.shtml>
order allow,deny
allow from all
</Files>

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www.)?mydomain.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www.)?seconddomain.com [NC]
RewriteRule .(zip)$ - [F,NC]

RewriteEngine on
RewriteCond %{HTTP_HOST} ^mydomain\.com$
RewriteRule ^(.*)$ [mydomain.com...] [R=301,L]

I've got some stuff for Wordpress in there, and then it goes straight on to the hotlinking. I've got my domain listed as well as "seconddomain.com", so that they can link to my ZIP files directly. I then have a redirect in there, since my Wordpress installation is on www.mydomain.com, to redirect to that if they don't happen to use the www.

Now, for the problem. That seconddomain.com is still unable to link to my ZIP files, regardless of the exception that I made for them.

Any ideas on what I'm missing here? And thank you in advance.

[g1smd]

The rewrites are processed first, so it's too late to do the following redirects. Indeed, if they are done, you will get all sorts of funky results - especially for non-www requests where the internal path will be re-exposed back out into the URL.

You need to order this stuff like this:
- most specific redirects first (affects low number of pages).
- general non-www to www redirects next.
- rewrites last.

You have also either duplicated the RewriteEngine On directive or you don't have it placed early enough on in the file.

RewriteCond lines are "this AND this" unless you add [OR] to all but the last RewriteCond.

[slshimerdla]

Okay, so I only need one RewriteEngine on, and I'll place that up near the top.

However, you'll have to forgive my ignorance. I'm self-taught when it comes to this stuff, and I learn all this stuff as I go along. So, while I'm finding snippetts of the code I need, I'm not as sure how it all fits together yet. Your statement helped some, and thank you.

So, basically I change it to this:

ErrorDocument 404 /404.shtml
Options All -Indexes
RewriteEngine on
<IfModule mod_rewrite.c>
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
RewriteCond %{HTTP_HOST} ^mydomain\.com$
RewriteRule ^(.*)$ http://www.mydomain.com/$1 [R=301,L] 
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www.)?mydomain.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www.)?seconddomain.com [NC]
RewriteRule .(zip)$ - [F,NC]

The seconddomain.com is still not able to link to my ZIP file for successful downloads, so I must not have fully understood.

I understand what you meant when you said the non-www to www redirects and then the rewrites last, but I wasn't sure about the "most specific redirects first" part. Is there any way that you could re-order that code there for me to show me an example of what you mean?

Thank you so much!

[jdMorgan]

You need to order this stuff like this:
- most specific redirects first (affects low number of pages).
- general non-www to www redirects next.
- rewrites last.

To which I will add "but you may want to place your access control code before all that, as there is little benefit to wasting time redirecting or rewriting unwelcome requests."

ErrorDocument 404 /404.shtml
Options All -Indexes
RewriteEngine on
<IfModule mod_rewrite.c>
RewriteBase /
#
# Deny hotlinked requests for .zip files
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example\.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?seconddomain\.com [NC]
RewriteRule \.(zip)$ - [NC,F]
#
# Externally redirect requests for example.com<anything> to www.example.com
RewriteCond %{HTTP_HOST} ^example\.com
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]
#
# [ Alternative solution for preceding rule (more thorough) ]
# Externally redirect requests for all non-blank non-canonical
# hostnames to the canonical www.example.com host
RewriteCond %{HTTP_HOST} !^(www\.example\.com)?$
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]
#
# Internally rewrite all requests which do not resolve to a
# physically-existing file or directory to the index.php script
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

You can omit the <IfModule> container unless you want this code to fail silently when installed on a server that does not have mod_rewrite loaded.

[added] Be sure to completely flush (delete) your browser cache after changing any server-side code and between every test using allowed and disallowed linking domains. Otherwise, your browser will show you the previously-cached resources and server responses. [/added]

Jim

[slshimerdla]

Awesome. Thank you SO much, Jim! Both of you. Much appreciated. I hadn't thought about caching when it came to this, thanks for the heads up. It's probably working now, but was cached. Ah well, at least my htaccess will be well formed now. Thanks, and have a great weekend!