Hotlinking Kinda Works.

Block, Image, Hotlinking

[EastTexas]

Works on the Utility Domain, but not External Domains.
It only Hides the image, but does not “Replace the stolen pics w/ the no-hotlinking Pic”

# Block Image Hotlinking
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.org [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://example.org/images/no-hotlinking.png [NC,R,L]

[edited by: phranque at 9:39 am (utc) on Mar 13, 2014]
[edit reason] Please Use example.com [webmasterworld.com] [/edit]

[lucy24]

<tangent>
Why on earth do you want to redirect? That's just telling them where the image really lives-- and turning a single unwanted request into two. Quietly rewrite instead. If you've got zillions of sites and can't be bothered with keeping a separate NO HOTLINKS image on each, you'll need something with a proxy flag.

(www\.)?some-example.org

You see this all the time, but it's actually incorrect. You've got a domain-name-canonicalization redirect, right? That means anyone visiting a page of your site is on either example.org or www.example.org, but never both.

And psst!
"jpg|jpeg" = "jpe?g"
</tangent>

Does your no-hotlinking code include an exemption for the no-hotlinks image itself? Otherwise nothing will ever be served. Same principle as poking holes for your 403 page.

[EastTexas]

I hate to ask, what is the correct code?

[lucy24]

:: detour to own htaccess ::

RewriteCond %{HTTP_REFERER} !^http://www\.example\.com/
RewriteCond %{HTTP_REFERER} !^-?$
RewriteCond %{HTTP_REFERER} !google
RewriteCond %{HTTP_REFERER} !translate
RewriteCond %{HTTP_REFERER} !\w+\.bing\.com/images/
RewriteCond %{HTTP_REFERER} !search\.yahoo\.com
RewriteCond %{HTTP_REFERER} !images\.yandex
RewriteRule \.(png|jpe?|gif)$ /pictures/hotlink.png [L]

The exact list of authorized referers is a matter of personal choice. Mine includes a couple of forums where I personally might have posted an image that lives on my site. Each site's htaccess also names the other sites. You definitely have to list two things: the canonical form of your own sitename, and blank. (In addition to search engines, some browsers don't send a referer.) My list is pretty generous.

If you don't want your pages to come up in image search, or in page translations, I'd use a different approach:

RewriteCond %{HTTP_REFERER} !\w+\.bing\.com/images/
RewriteCond %{HTTP_REFERER} !search\.yahoo\.com
RewriteCond %{HTTP_REFERER} !images\.yandex
RewriteCond %{HTTP_REFERER} !translate
RewriteRule \.(png|jpe?|gif)$ /pictures/smallgifs/onedot.gif [L]

That's your ordinary administrative gif: 1x1 pixel, transparent. Put that part before the anti-hotlinks part. Then, still earlier, you have a line that says something like

RewriteRule (hotlink\.png|onedot\.gif) - [L]

so nobody goes around in circles.

No, I don't know why it says \w+\.bing. There's probably some historical reason; I've just never changed it.

Just the other day I made the slightly horrifying discovery that the "opt-out" section of my legal page displays the NO HOTLINKS image where it should be showing a bit of piwik text inside an iframe. Had to do with some careless cut-and-paste work after the site move. Fixed now, but how awful for the visitor!

[EastTexas]

Thanks for the code, but I get the same problem.
images disappears, but no replaced images.
It may be it's the web host?

[g1smd]

Lucy, one typo: jpe? should be jpe?g

Make sure you clear your browser cache before each test.

[lucy24]

images disappears, but no replaced images.

I hope you replaced "/pictures/hotlink.png" with the URL of your own No Hotlinks image :)