Member Avatar for TheChosen0ne

How do I do that?
I have a few pictures and avatars I made for my friends, but I don't want them to use the images without permission. How do I protect my images?

  • 2 Contributors
  • 2 Replies
  • 193 Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by TheChosen0ne

Dani AI

Generated

Good quick answer from — referer-based blocking is the usual, low-effort way to stop casual hotlinking. It’s effective for most cases and many shared hosts expose a one-click setting for it. That said, referer checks are a deterrent, not a full-proof lock.

Two important caveats to keep in mind: the HTTP Referer header can be empty or intentionally spoofed, and some browsers or apps strip it for privacy. Blocking empty referers will stop some legitimate requests (bookmarks, some email clients, image viewers), so decide whether to allow empty referers. Also remember to include every hostname/protocol variant you serve from (http, https, www, non-www, CDNs, subdomains) when configuring allowlists.

If you need alternatives or stronger protection:

  • Use a CDN or storage service that supports signed (time-limited) URLs — this prevents direct linking without an authorization token.
  • Serve images through a small server-side script that checks a session, token, or origin before streaming the file.
  • Add a visible watermark or reduced-resolution copies for publicly embedded images; keep originals out of public folders. Watermarks protect attribution even when images are copied.

Quick practical pieces you can use now:

  • Nginx example (adapt domain names to yours):
location ~* \.(jpg|jpeg|png|gif)$ {
    valid_referers none blocked example.com *.example.com;
    if ($invalid_referer) {
        return 403;
    }
}
  • Test how the server sees referers with curl:
curl -I -e "http://othersite.example/" "https://example.com/images/pic.jpg"

Troubleshooting checklist: confirm mod_rewrite/mod_security behavior (or Nginx config), check file locations and overrides, test both http/https and www/non-www, and clear caches. Combine methods (referer checks + watermarking or signed URLs) for the best practical protection — no single server-side trick will stop a determined scraper who downloads and re-uploads images.

Recommended Answers

All 2 Replies

Member Avatar for Dandello

Most hosting services offer hotlink protection. Otherwise you need access to your document root .htaccess file

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^      [NC]
RewriteCond %{HTTP_REFERER} !^      [NC]
RewriteCond %{HTTP_REFERER} !^      [NC]
RewriteCond %{HTTP_REFERER} !^      [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - [F,NC]

This is from one of my sites with hotlinking protection turned on. Needless to say, replace 'yoursite' with the url of your site.

What it does is prevent any site other than yours to access the image files.

There are other codes that can be added but this is a basic one.

commented: GENIUS! +1
Member Avatar for TheChosen0ne

YOU're a genius!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.