Hotlink protection

for all directorys except one

[huwnet]

I need some help writing a rewrite to hotlink my images.

I would like to block all domains (except the one I am on) from accessing my images files.

However anyone should be able to access anything from the /f folder.

I would appreciate some help writing this.

Thanks

[huwnet]

I found a WW post that has a hotlink tutorial.

[webmasterworld.com...]

However in order to allow hotlinking on one folder they use a workaround to turn off the rewrite engine for that folder.

Ideally I have some other rewrite rules I need to apply to that folder so I cant turn the engine off.

[jdMorgan]

You could simply add a RewriteCond %{REQUEST_URI} line that bypasses the hotlink code for the one directory.

RewriteCond %{REQUEST_URI} !^/path_to_the_allowed_directory/

Jim

[huwnet]

This is a bit messed up (/edit only messed up in preview), but if this is my code:

RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http(s)?://(www\.)?domain1 [NC]
RewriteCond %{HTTP_REFERER}!^http(s)?://(www\.)?domain2 [NC]
RewriteCond %{HTTP_REFERER}!^http(s)?://(www\.)?domain3 [NC]
RewriteRule \.(jpg¦jpeg¦png¦gif¦swf¦css)$ [domain1...] [NC,R,L]

Is this just added afterwards?

RewriteCond %{REQUEST_URI}!^/f/

[huwnet]

Anyone?

[jdMorgan]

I'd suggest:

RewriteEngine on
RewriteCond %{REQUEST_URI} !^/f/ 
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?domain1 [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?domain2 [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?domain3 [NC]
RewriteRule \.(jpe?g¦png¦gif¦swf¦css)$ /f/block.gif [NC,L]

The change to the RewriteRule makes this an internal rewrite instead of an external 302 redirect. This 'hides' the action from the hotlinked visitors, and also will prevent problems with 302 handling by search engines.

I changed '!^$' to '.' and 'jpg¦jpeg' to 'jpe?g' for the sake of efficiency -- they are completely equivalent.

Jim

[huwnet]

Thanks I will try it and post back if I have any problems

[huwnet]

I put this in the root htaccess but this is having no affect and all images can still be hotlinked.

Any ideas why it might not work?

[phantombookman]

Anyone with any ideas for those of us on windows servers or without htaccess?

Is there anything safe and reliable that does not require code adding to every page?

[jdMorgan]

huwnet,

Did you flush your browser cache to eliminate cached images, and test from a 'hotlinked' page?

Also, you may or may not need to add

Options +FollowSymLinks

above the RewriteEngine directive as well.

Jim

[huwnet]

That does not work either.

If it helps my full .htaccess is:

Options -Indexes
Options +FollowSymLinks 
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/f/
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?examp.org.uk [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.net [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.org.uk [NC]
RewriteRule \.(jpe?g¦png¦gif¦swf¦css)$ /f/block.gif [NC,L] 
RewriteCond %{HTTP_HOST} ^www\.example\.org.uk$ [NC]
RewriteRule ^(.*)$ http://example.org.uk/$1 [R=301,L]
RewriteCond %{HTTP_HOST} ^(.*)old_domain.com [NC]
RewriteRule ^(.*)$ http://example.org.uk/ [R=permanent]

[edited by: jdMorgan at 4:11 pm (utc) on Jan. 7, 2006]
[edit reason] No URLs, please. See Terms of Serivce. [/edit]

[jdMorgan]

Well, I still don't see anything wrong with your code that would cause it to fail.

I'd write it like this:

Options +FollowSymLinks -Indexes
RewriteEngine on
#
RewriteCond %{REQUEST_URI} !^/f/
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?(examp\.org\.uk¦example\.net¦example\.org\.uk) [NC]
RewriteRule \.(jpe?g¦png¦gif¦swf¦css)$ /f/block.gif [NC,L]
#
RewriteCond %{HTTP_HOST} ^www\.example\.org\.uk [NC,OR]
RewriteCond %{HTTP_HOST} old_domain\.com [NC]
RewriteRule (.*) http://example.org.uk/$1 [R=301,L]

Now, if this still does not work, please be very specific about *how* it does not work. That is:

How did you test?

What did you expect to happen?

What did happen?

If you get an error, please post the relevant lines from your server error log file.

Be sure to flush your browser cache between tests, and change all broken pipe "¦" characters to solid pipes before trying to use this code; posting on this board modifies that character.

Jim

[huwnet]

I tryed adding the new .htaccess.

I cleared the browser cache (Ctrl + F5)

I then accessed another webpage that I made which has my site images from a domain that wasn't allowed (using FF 1.5)

All images were displayed.

The only error I have found is that cpanel has:

[Sat Jan 7 05:50:15 2006] [alert] [client 81.153.27.47] /home/huwnet/public_html/.htaccess: RewriteCond: bad argument line '%{REQUEST_URI}!^/f/'\n

In the error log

Sorry to sound stupid but I didn't get the bit about pipes

[jdMorgan]

Pipes: These five characters are broken pipes -> ¦¦¦¦¦
When I posted them, they were solid vertical bars, but posting here modifies that character.
The broken pipes are not valid in regular expressions as used in mod_rewrite.
You must edit them and change them back to solid pipes before using any code posted anywhere on WebmasterWorld.
The solid pipe character is usually Shift-\ on a U.S. 101-key keyboard.

> RewriteCond: bad argument line '%{REQUEST_URI}!^/f/'\n

There's a space missing between the "}" and the "!" in that line of your code then.

Jim

[huwnet]

Thanks it now works :D