How to protect images from being hotlinked?

Question

I have tried the below code in htaccess to stop my images from being hotlinked, but it is not working.

SetEnvIfNoCase Referer "^http://www.example.com/" locally_linked=1
SetEnvIfNoCase Referer "^http://www.example.comm$" locally_linked=1
SetEnvIfNoCase Referer "^http://example.com/" locally_linked=1
SetEnvIfNoCase Referer "^http://example.com$" locally_linked=1
SetEnvIfNoCase Referer "^$" locally_linked=1
<FilesMatch "\.(gif|png|jpe?g|css|js)$">
  Order Allow,Deny
  Allow from env=locally_linked=1
</FilesMatch>

Can anyone help me with how to prevent hotlinking?

You mean hotlinking. If you didn't want images to be saved at all you would have to keep it off of the Internet completely. — John Conde, Sep 07 '12 at 19:29
I don't know apache, but should the last one be locally_linked = 0? also, do you need a deny after the allow? — Darren Kopp, Sep 07 '12 at 19:29
It will be easier that you don't completely block linking, instead display a Special Error Image using htaccess. — Ankit, Sep 07 '12 at 19:53
Regarding empty referrer, I came across sites which add to all their web pages, so all the hotlinked images would be requested with empty referrer. — Uri Raz, Oct 01 '22 at 13:23

score 2 · Answer 1 · edited May 23 '17 at 11:56

2

This will show a fixed image whenever its hotlinked. (That image may have a message that Hotlinking in not allowed...)

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain\.com [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ /images/nohotlink.jpg [L]

It checks Refererr is not nothing, and referer is not matching mydomain then it responds with the image nohotlink.jpg.

To understand hotlinking prevention better see these SO threads:
Apache .htaccess hotlinking redirect
Apache Hotlink Protection for Download Folder
A Basic tutorial http://altlab.com/htaccess_tutorial.html

edited May 23 '17 at 11:56

Community

1
1

answered Sep 07 '12 at 20:30

Ankit

1,471
17
29

i have already tried all the help link given by you. Which is not working – Mughil Sep 07 '12 at 21:57
@Ankit: isn't your code allowing hotlinking from a site at `http://mydomain.com.otherdomain.com` – Marco Demaio Dec 01 '12 at 12:58

score 0 · Answer 2 · answered May 01 '13 at 04:00

This disallows anything from hotlinking unless the referer is from example.com.

SetEnvIf Referer example\.com localreferer
<FilesMatch \.(jpg|png|gif|css|js|pdf|doc|xls|txt)$>
    Order deny,allow
    Deny from all
    Allow from env=localreferer
</FilesMatch>

How to protect images from being hotlinked?

2 Answers2

Linked