How many users change HTTP REFERER?

Is it wise not to ban hotlinking?

[kiwibrit]

Many methods advise to stop image hotlinking rely on the HTTP_REFERER variable. But I understand some browsers allow the user to change this header. Is this so? If so, which browsers, and how easy is it to do?

I ask because I am wondering if it is wise to ban hotlinking with htaccess using HTTP_REFERER.

[le_gber]

I think it's two different things:

the client http_referrer is where (page / site) they came from

the imagfe holinking http_refferer is to check that it is your own website that requested the image file

you can therefore have the hotlinking protection without worrying about the visitors blocking http_refferer.

[kiwibrit]

Thank you.

So:

Options +FollowSymlinks
RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?mydomain.com(/)?.*$   [NC]
RewriteRule .*\.(gif¦jpg¦jpeg¦bmp¦png)$ - [F,NC]

should not cause problems to those who have altered their browser settings?

[leadegroot]

Its possible that a person could change their setting so their referer always says 'fred nerks! hahahahaa!' for all hits
This person would not see your images form your site, even when viewing your pages.
This is their problem, I believe. If they are going to fiddle with how they interact with the internet then they should expect that will be breaking some of the functionality.
IMHO

[kiwibrit]

OK. I'll stick with the hotlink blocking I have, for the moment, but watch my webstats to see referrers.

I have not been worried about the oddballs. But it has occurred to me that some might be changing their referrer settings as an anti-spy measure. If that becomes a corporate tendency, then I would be worried.

[sja65]

I change the path to my images every month, only allowing this months and last months path to actually work. After the two months, I always display the same image that has text on it saying to visit my website to see the real image. This way, doesn't matter what they have for referrer, people can hotlink (but only for awhile - and then they have an advertisement for my site).

[leadegroot]

I see plenty of people deleting/blocking the referer, but its very rare to see it altered.
(Does anyone else see those strange referals like 'http://google/'?)

[KenB]

I'm discovering that a lot of the hits with blocked/faked referrers are actually generated by bad bots like site scrapers and referrer spamming bots.