Anti-Hotlinking in plain English, please?

[Pagan]

I will admit this is one area I need a better guide to. When I have tried this or that technique in the past, I shot myself in the foot and was unable to see any images on my domain. I can't get by on just mimicking what I see others doing - I need to really understand this area as I have now been hit by the third round of hotlinking. I have used anti-hotlinking functions available through the control panels on two of the three hosts, but obviously there is a work around and/OR I didn't do it right for my needs.

Let's say I have two domains on the same host, under the same account. Let's call them Domain A and Domain B just to be simple and clear. Both domains have freesites and galleries plus blogs. Domain A never shares anything with Domain B except for text links. All graphics and images for the sites on Domain A are housed in subdirectories. Same goes for Domain B. I don't call any images or files from Domain B on sites on Domain A and vice versa.

When I build a freesite, I have a structure similar to this:
Domain A
Freesite or Gallery folder
Individual Site
folder for pics
folder for thumbs
index.html
site pages
folder for mirror 1
folder for mirror 2

Individual Site
folder for pics
folder for thumbs
index.html
site pages
folder for mirror 1
folder for mirror 2

Rinse, lather, repeat

My folders for mirrors only contain the .html pages, and I call the images from one directory level up, so to call an .jpg up from mirror one, it is ../images/pornpic.jpg. I do have a very few sites on my oldest domain that call sponsor banners from a central image folder, but it is all within that domain.

So, if I wanted to write anti-hotlinking for my .htaccess file to block everyone but me from hotlinking within the one domain, what is the best way to do it? What about the handful of link lists that want a tiny preview image - better to put those in a directory and allow access? Does it vary from server to server? What is the most efficient way for page load time and server load? Are there ways for the determined hotlinkers to get around it? I did read through several earlier discussions about .htaccess but am not afraid to admit it didn't really make sense and the sites I have hit on the mainstream side of the house were not much better.

Now be gentle guys, please. I know the logic is there if I can only find the beginning of the thread to follow.

Thanks much!

[pc]

Pagan I have this in my .htaccess and works great but you need to include so many url's as you need to enable hotlinking.

## DISABLE HOTLINKING
RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?lezzietown.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?rearentrylovers.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?eroticove.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?whatever.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?whatever.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?whatever.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?whatever.com/.*$ [NC]
RewriteRule \.(gif|jpg|jpeg|png|js|css)$ - [F]

I hope this helps

[Cleo]

Try this
http://www.htaccesstools.com/hotlink-protection/

[cd34]

From Greenguy and Jim FAQ you could use those rules. Raymor refined those and I find them to be about as bulletproof as you can get.

RewriteEngine on
# leave this line in allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)?yourdomain\.com([0-9]+)?(/.*)?$ [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ - [NC,F,L]

You can add in additional lines above the RewriteRule like:

RewriteEngine on
# leave this line in allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)?yourdomain\.com([0-9]+)?(/.*)?$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)?anotherdomain\.com([0-9]+)?(/.*)?$ [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ - [NC,F,L]

or, you could do something like:

RewriteEngine on
# leave this line in allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)?(yourdomain\.com|anotherdomain\.com|andathirddomain\.com)([0-9]+)?(/.*)?$ [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ - [NC,F,L]

as far as performance, every line that is in your .htaccess file needs to be parsed. The fewer lines you have, the quicker it is going to parse it and the regexp engine within apache is pretty good.

For ease of use, a separate line for each domain probably won't be much of a performance hit.

[Cleo]

It this line case sensitive the way you have it written?

RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ - [NC,F,L]

Also if you want to serve up a hotlink image do you write it like this.

RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ path/to/hot.gif [NC,F,L]

[cd34]

The NC in the rule means, NoCase

yes, you can write it like that, but, you should put a RewriteEngine off in the .htaccess in the directory where your hotlink image to display is.

[Cleo]

Your example seems to work really well in my brief testing that I just did and my htaccess has gone from hundreds of lines to just 30 lines.

I added a few more file types into mine.

RewriteRule .*\.(css|asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip|png|swf|mp4|m4v)$ - [NC,F,L]

[cd34]

remember that .wmv isn't able to be protected -- windows media player doesn't send a referrer.

[Cleo]

Yeah it is kind of ironic that you can hotlink protect just about anything except a wmv file.

That is the reason I never use them.

[Pagan]

Hmmm.. okay. I am starting to understand it a little. Is it better to do an .htaccess for each domain?

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?eroticove.com [NC]
RewriteRule \.(jpg|gif)$ - [NC,F,L]

If I follow you all right, that should be only what I need to protect my images (I only use .jpg and .gif) from all outside hotlinkers, but allow my sites to share those images. But can something so light be enough? Are there ways around it? Do I really need to block IPs?

Here's the .htaccess file I had up through March, and I still had a ton of issues with hotlinking.

#--ANTI-HOTLINK--
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^(http://|https://)(www.)?(eroticove.com).*$ [NC]
RewriteRule \.(jpe?g|gif|bmp|png|.wmv)$ - [F]
#++ANTI-HOTLINK++
ErrorDocument 404 /error.html
ErrorDocument 403 /error.html
ErrorDocument 500 /error.html

[cd34]

From the hotlinking I've seen in the access logs, those rules should have worked.

The IP address blocks are not really that useful. I usually tend to use referrer blocking, allowing the empty referrer because some personal privacy software sends a blank or invalid referrer and leave it at that. If you start blocking IPs, you're going to get a very long list very quickly and are going to have to continue adding IPs as you find them.

I can see that those rules are currently working. My assumption is that for some reason, AllowOverride was disabled for your webspace and your rules weren't being used, or, an .htaccess file further down in your directory structure turned RewriteEngine off or specified a different rule. Without RewriteOptions Inherit, any RewriteRules placed in a lower directory take precedence.

[Pagan]

uh, folks.. this is why Sparky rocks. Any guy that takes the time and patience to check things out carefully, explain it to dummies, and then make logical recommendations is at the top of the list in my book. I am not a new webmistress by any means, but having to deal with issues like this and a code where one character can spell ruin is beyond most of our skillsets. I do wish the host I was with for the last 5 years had taken the time to do this. It would have saved me hours and hours of work and stress.

[flip.green]

Good advise on htaccess rules, as far as load is concerned. Any modern server should be able to handle blocking hotlink requests, without increasing load under normal circumstances.

[nate]

.htaccess is utterly impotent against hotlinkers using javascript on the client's computer to steal your images... unless you reject blank referrers.

[Tanker]

I love Htaccess! its saved me a ton over the years but WMV not being protected has always drove me nuts