Blocking remote-linking (bandwidth stealing)

[Relativity]

This is in effort to block a troublesome individual from linking to my site and thus stealing content. I was able to successfully block the individual from linking to my page by using the following text in a .htaccess file:

SetEnvIfNoCase Referer "^http://www.hisdomain.com/" banned_ref=1
Order Allow,Deny
Deny from env=banned_ref
Allow from all

However now I'm encountering a different problem. This person has found a way around the block by using a simple meta http-equiv="Refresh". The page with the refresh is still on the banned domain so I would have expected it to be blocked as well, unfortunately it does work and he's able to refresh his page with mine. Apparantly the Refresh command doesn't pass along the host page as referrer info. I do not want this person to be able to link to my page in any way, including this Refresh approach. Any ideas on how to stop something like this? Thanks for your time!

[oilman]

Hi Relativity - welcome to WebmasterWorld :)

We've had several good discussions on using htaccess to stop hotlinking. Have a look at:
[webmasterworld.com...]
[webmasterworld.com...]

[kriskd]

Just wanted to thank both of you for this post. I came here with the exact same problem -- my images are being hot linked to and I'm not happy about it. Edited the .htaccess file and hopefully we got that problem taken care of. The images are the guts of my web page and even though I have bandwidth to spare, I put a lot of time into my site and those images are mine! :)

Kris

[plumsauce]

you need to use expiring links.

search slashdot for "rotating keys"
from a discussion in late august,
about 40% down the page.

++++

[kriskd]

It's late, and I'm too tired to deal with it now, but it appears the code I implemented to stop people from hot linking to my images is also preventing the images from appearing on my site for some people. Everything looks great here at home and on our friend's computer whom we visited tonight. However, when I got home, I had an e-mail from my mom and someone else asking about the images.

Any initial thoughts? Should I post my .htaccess file when I'm a bit more coherent tomorrow?

Thanks,
Kris

[jdMorgan]

kriskd,

The problem may be that you've blocked blank referers to fix the meta-refresh problem, and/but some of your "legitimate" users will have blank referers due to their ISP or corporate proxy server setup, or because they use software like Norton Internet Security.

If you want to see what your users are seeing, try flushing your browser cache, and type in the image URL directly (type-in = no referer). You'll have to flush your browser cache every time before you request the image to see the result.

Jim

[kriskd]

I'm not the person who had trouble with the thief using a meta refresh work around, however, I did get my problem corrected.

I actually host my main images (those that are the "guts" of my site) on a different server. The code that allowed my domain access to these had a slash ("/") at the end. Therefore, anyone who tried to view my site without the ending slash got the fill-in images. I removed the slash and my site works with and without the slash and the leading www.

So, I'm happy!

However, I just discovered someone else linking to another image on another web page that I really don't put much time & effort into. I'm not even using this image on the current version of the page, but obviously, it's still on the server. This one doesn't bug me as much for reasons I can't go into without explaining what my main site is all about and why these images are valuable to me.

So the question is, why do people link to static images? Why not just right-click and take them if they want them so bad? It leaves them wide open for the owner of the image to do something nasty back to them.

Kris