Forum Moderators: phranque
# Prevent offsite links to download.htm
SetEnvIfNoCase Referer ^http://www\.your-domain\.com local
SetEnvIfNoCase Referer ^http://your-domain\.com local
SetEnvIf Referer ^$ local
<Files ~ "download\.htm$">
order deny,allow
deny from all
allow from env=local
</Files>
Simply put, I have: www.mysite.com that I ONLY want access to from 3 other sites. Thats it. No direct access to mysite unless the referrer is from one of those 3 sites. Goes for pictures too if possible. Also, I'm linking to mysite from flash links on those 3 sites, does this have an impact on the referrer? Big thanks to anyone that can help.
Welcome to WebmasterWorld [webmasterworld.com]!
Sorry for the delay - A better title on this thread would have gotten a faster answer...
Fill in the domain names of the authorized referrers, and this should work:
# Prevent unauthorized access to all files
SetEnvIfNoCase Referer ^http://(www\.)?your_domain\.com allowed
SetEnvIfNoCase Referer ^http://(www\.)?allowed_domain1\.com allowed
SetEnvIfNoCase Referer ^http://(www\.)?allowed_domain2\.com allowed
SetEnvIfNoCase Referer ^http://(www\.)?allowed_domain3\.com allowed
SetEnvIf Referer ^$ allowed
SetEnvif Remote_Addr 192.168.0.0 blockip
<Files *>
order allow,deny
allow from env=allowed
deny from env=blockip
</Files>
Note that not all browsers, spiders, and other user-agents will provide a referer. In the case that no referrer is provided, the
SetEnvIf Referer ^$ allowed directive will allow them. This constitutes a "hole in the wall," but there are simply too many problems with blocking referrer-less user-agents. If someone gets past the block by witholding their referrer. you can always block them by their IP address as shown.
Ref: Apache documentation [httpd.apache.org]
HTH,
Jim
Just making sure, will this prevent (most) browsers from being able to reach mysite.com unless they come from one of my other 3 sites? I know there is a line in there that allows no referrals...but...doesn't that mean everyone? I mean if you just type in the site directly, does that give the referral as local or does it give no referral at all? My main concern is ensuring no one can just manually type in my url and reach it. I've seen it done on alot of sites just not exactly sure how to edit it myself to do it.
Again, thank you VERY very much for this big help, saved me alot of anguish.
SetEnvIfNoCase Referer ^http://(www\.)?123.456.ip.ip\.com allowed
I learned it by reading the cited documentation - and messing it up a lot. :)
If someone types in your URL, there will be no referrer, so the code above will allow access. You can delete the line which allows no referer, and deal with the complaints, or you can take another approach, and that is to redirect visitors with no referrer to a password-required page before allowing entry. This can be done with either the built-in password protection, or with a script.
Conditional redirection will also require the use of Apache mod_rewrite, or this function could be built into the same script that does the password protection. Again, looking through the Apache documentation may help you to make up your mind about which way you want to go. Note that mod_rewrite is not available on all Apache servers; many "budget" hosting services disable it because it is very powerful. This leads to mistakes and problems that raise their customer-support costs.
Ref: Introduction to mod_rewrite [webmasterworld.com]
You can test to see if mod_rewrite is available to you using the following code, placed in your .htaccess file:
Options +FollowSymLinks
RewriteEngine on
RewriteRule ^testmodrw\.html$ /index.html [L]
After adding the code and uploading the new .htaccess file to your site, type "http://www.yourdomain.com/testmodrw.html" into your browser address bar. If it works, you should be redirected to your index.html page. If not, you will likely get a 500-Server Error, and your browser will show nothing. Remove the new code by uploading your backup .htacess file, and then check your site error logs if you have access to them.
If you do get an error, you can also try just removing the first line - "Options +FollowSymLinks" and try again. If it still does not work, then it is most likely you do not have access to mod_rewrite.
If you use an IP address, you should delete the "(www\.)?" part:
SetEnvIfNoCase Referer ^http://123\.45\.67\.89\.com allowed
...Off for a day of weekend stuff - No computers involved! :)
Jim
SetEnvIfNoCase Referer ^http://123\.45\.67\.89\.com allowed
You must use something like:
SetEnvIfNoCase Referer ^http://123\.456\.789\.01/.*$ [NC] allowed
Now the jpegs work again but I still can't get to the site via a flash link, normal txt links will work. Sooooo close. Does flash not send a referral? Is this the wrong section to ask about flash? Thanks again for your help and hope you have a great single day weekend ;)
I think this is because right clicking doesn't offer the .htaccess the referer it needs, regardless if it is on the page. Is this true? If so, is there anyway around this?
