mod_rewrite hotlink protection question

[tommygunner]

I have mod_rewrite working in APache 2 so that it redirects hotlinkers.

This is what I have: I want to know if there is way to make it so that it works on all of goodomain.com for other folders such as goodomain.com/2/ gooddomain.com/3/ etc. Right now it only works from main domain. People can still hotlink other directories within goodomain.com.

RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?gooddomain.com(/)?.*$ [NC]
RewriteRule .*\.(gif¦jpg¦jpeg¦bmp)$ [stopspammers.com...] [R,NC]

I don't want to have to keep adding new directories to it each time. Isn't there a way I hotlink protect all directories within domain?

[tommygunner]

If I have to put .htaccess in all subdirectories, how does following below look: I tested this out and it works in subdirectories too (when I copy it there) without having to change domain.

RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?goodref.com(/)?.*$ [NC]
RewriteRule .*\.(gif¦jpg¦jpeg¦bmp¦wmv¦wma¦png¦mpeg¦mpg¦avi¦mp4)$ [spamforspammers.com...] [R,NC]

How does this look? Is it efficiently coded, or is there a better code?

[jdMorgan]

All of this depends on how your subdomains are implemented. If each subdomain points to its own subdirectory (without your having to do it in your top-level .htaccess file), then you'll have to put the code in each subdirectory, unless you have access to httpd.conf.

You have some unnecessary patterns in your regular expressions, which can simply be omitted for the sake of efficiency without changing the function. Specifically, leading and traillng ".*" patterns are redundant and don't do anything.

Also, redirecting an image request to an html (or html-like) page won't work -- browsers can't handle it. I suggest you simply return a 403-Forbidden response.

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?goodref\.com [NC]
RewriteRule \.(gif¦jpe?g¦bmp¦wm[av]¦png¦mpe?g¦avi¦mp4)$ - [NC,F]

Jim

[tommygunner]

Yes, I learned about not being able to see image in html page. I'm also setting up custom error pages for 404, 403, 500.

I'm putting all my ErrorDocument stuff in my <VirtualHost> directive in Apache. It handles all of site then and will do subdirectories as well.

Any chance that I can throw in the mod_rewrite code in <Virtualhost> area to do the same instead of using .htaccess files?

[jdMorgan]

> Any chance that I can throw in the mod_rewrite code in <Virtualhost> area to do the same instead of using .htaccess files?

Yes, like all Apache directives, each mod_rewrite directive states what context it is available in. Check the documentation [httpd.apache.org] for each directive you wish to use.

Jim