htaccess prevent hotlink also prevents external links

Question

I've got this code in my .htaccess file to prevent hotlink of images and pdf files but it is also preventing normal external links to work. My htaccess file:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mywebsite.com/.*$ [NC]
RewriteRule .*\.(gif|jpg|pdf|png)$ http://www.mywebsite.com/images/notallowed.jpe [NC,R,L]

Problem is that a legitime external link to say a pdf file will cause the replacement image to appear instead of the pdf file. ¿Is this normal or what am I doing wrong/missing? Thanks in advance.

jerdiggity · Answer 1 · 2013-04-20T04:11:01.647

2

I'd give this a try...

RewriteCond %{HTTP_REFERER} ^$ [OR]
RewriteCond %{HTTP_REFERER} !^https?://(?:www\.)?mywebsite\.com(?:$|/) [NC] [OR]
# Repeat the next line as needed for each allowed site
RewriteCond %{HTTP_REFERER} !^https?://(?:www\.)?allowedsite1\.com(?:$|/) [NC] [OR]
RewriteCond %{HTTP_REFERER} !^https?://(?:www\.)?allowedsite2\.com(?:$|/) [NC]
RewriteRule ^(.*)\.(gif|jpg|pdf|png) http://www.mywebsite.com/images/notallowed.jpe [NC,R,L]

Might be kind of inconvenient to manually add each allowed site, but it should give you some control... Other possible drawback would be that the people visiting a raw image, for example, would have to do so via an existing link found within the site.

Example: typing http://www.mywebsite.com/logo.png into your browser and trying to directly view the file logo.png wouldn't work, but you shouldn't have a problem viewing the same file if you click on <a href="http://www.mywebsite.com/logo.png"><img src="http://www.mywebsite.com/logo.png" /></a>.

Hope that helps someone...

edited Apr 20 '13 at 04:11

answered Apr 19 '13 at 20:39

jerdiggity

3,655
1
29
41

Thanks for your answer. I've tried but nope! Doesn't work either. I don´t really understand why. – haddock Apr 20 '13 at 01:58
Yeah actually I meant to edit that answer (which maybe I'll do right now, just for everyone else who might be in a similar situation), because I realized that will block everyone who's not listed as "allowed" (e.g. the entry on the second line). – jerdiggity Apr 20 '13 at 03:57
No way. It doesn`t work. Let me explain. If I put a pdf file of mywebsite in an iframe (outside my web site) the pdf is replaced by the image which is what I want. But if in the same program I put a link like the pdf still is not showing, it gets replaced by the image which is not what I need. So I don't see this as a problem of adding more allowed sites but to change something else in the code instead. Thanks again anyway. – haddock Apr 20 '13 at 11:11

Paul Sweatte · Answer 2 · 2013-10-08T21:02:10.363

0

Use SetEnvIf instead:

SetEnvIf Referer ^http remote

<FilesMatch "\.(png|gif|jpg|pdf)">
  order deny,allow
  deny from env=remote
  allow from all
</FilesMatch>

edited Oct 08 '13 at 21:02

answered Oct 08 '13 at 20:56

Paul Sweatte

24,148
7
127
265

htaccess prevent hotlink also prevents external links

2 Answers2

Linked