Member Avatar for vectro

I use this as anti-hotlink protection for images. example.com is the domain which is allowed to hotlink images while all other domains are denied. This code also allows direct requests to image files using a browser's URL bar, but not hotlinking from another site.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://example.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^ [NC]
RewriteCond %{HTTP_REFERER} !^ [NC]
RewriteCond %{HTTP_REFERER} !^ [NC]
RewriteRule .*\.(.*.*.*gif|jpg|jpeg|png|bmp|tif|tiff)$ [url] [R,NC]

This example blocks entire file extensions. As an alternative, does anyone know how to change the info in the last line of this so that it will block hotlink access to a specific file such as example.jpg or even example.php?

  • 2 Contributors
  • 5 Replies
  • 1K Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by vectro

Dani AI

Generated

's RewriteCond/RewriteRule approach (the one you tested) is a tidy, minimal way to stop hotlinking a single dynamic file while still allowing direct browser requests and links from your own domain. 's <Files> suggestion will hide the file completely (useful when you want it unreachable), but it also blocks normal direct requests. Remember that the Referer header is optional and can be omitted or changed by clients, so it is not a reliable security boundary on its own — see the Referer spec for details. (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer)

A practical, robust alternative for a PHP endpoint is a short server-side check inside the file itself. Put this at the top of the PHP file to allow empty referers (direct bookmarks) and any referer from your domain, but return 403 for cross-site embedding:

<?php
$ref = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
if ($ref !== '') {
    $host = parse_url($ref, PHP_URL_HOST);
    if (!$host || !preg_match('/(^|\.)example\.com$/i', $host)) {
        header('HTTP/1.1 403 Forbidden');
        exit;
    }
}
?>

If you truly want to hide the file from every request (not just hotlinkers), use Apache 2.4 access control inside a <Files> block instead of the older Order/Allow/Deny syntax:

<Files "secretfile.php">
    Require all denied
</Files>

Quick troubleshooting: simulate external hotlinking with curl using curl -I -e "http://evil.example/" "https://yourdomain.example/yourfile.php" and check for a 403. Prefer returning a 403 (server-side or using mod_rewrite's [F] flag) rather than redirecting, to avoid confusing clients or caches. See the PHP $_SERVER docs for server variables and the Apache mod_rewrite flags docs for rewrite behavior. (https://www.php.net/manual/en/reserved.variables.server.php) (https://httpd.apache.org/docs/current/en/rewrite/flags.html)

Recommended Answers

All 5 Replies

Member Avatar for vectro

Prevent Hot Linking section

The only anti-hotlink code I found on that page blocks entire extensions and not single files. I need to block hotlink access to a single PHP file.

Member Avatar for Habitual

I use this as anti-hotlink protection for images. example.com is the domain which is allowed to hotlink images while all other domains are denied. This code also allows direct requests to image files using a browser's URL bar, but not hotlinking from another site.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://example.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^ [NC]
RewriteCond %{HTTP_REFERER} !^ [NC]
RewriteCond %{HTTP_REFERER} !^ [NC]
RewriteRule .*\.(.*.*.*gif|jpg|jpeg|png|bmp|tif|tiff)$ [url] [R,NC]

This example blocks entire file extensions. As an alternative, does anyone know how to change the info in the last line of this so that it will block hotlink access to a specific file such as example.jpg or even example.php?

Vectro:

To restrict access to a specific file, add the following code block and edit the file name, “secretfile.php”, with the name of the file that you wish to protect:

You can put this in a your site's root .htaccess or an .htaccess of it's own in the directory that contains /path/to/secretfile.php.

# prevent viewing of a specific file
<files secretfile.php>
 order allow,deny
 deny from all
</files>

Sometimes I will make you do the work, and sometimes I won't.
Here's a freebie: http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/

Member Avatar for vectro

Vectro:

To restrict access to a specific file, add the following code block and edit the file name, “secretfile.php”, with the name of the file that you wish to protect:

You can put this in a your site's root .htaccess or an .htaccess of it's own in the directory that contains /path/to/secretfile.php.

# prevent viewing of a specific file
<files secretfile.php>
 order allow,deny
 deny from all
</files>

Sometimes I will make you do the work, and sometimes I won't.
Here's a freebie: http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/

I believe your code would restrict ALL access to that file, not just hotlinkers. So, I don't believe this would help me. I'm also aware of the page you linked. It includes examples of hotlink protection for entire extensions, but not for individual files.

I think someone in another forum has showed me something more along the lines of what I need. I haven't test it yet, but just to show you:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?example.com/ [NC]
RewriteRule ^browse\.php$  [R,NC]

I think this would restrict hotlink access to browse.php while still alowing example.com to link to it and would also allow direct requests via the URL bar in the browser. Can anyone confirm this?

Edited by vectro because: n/a
Member Avatar for vectro

I finally got around to testing the above code myself and it worked perfectly.

Edited by vectro because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.