David Walsh Blog

Prevent Image Hotlinking With .htaccess and mod_rewrite

One way to kill your website’s bandwidth and overall download speed is to not block image “hotlinking.” What’s hotlinking? Hotlinking is linking to a file on an external server that the Web Developer does not own (most of the time the Web Developer doesn’t even have permission to use the file). Hot linking occurs mostly with images.

Why would another website hotlink to a file on your server? There are a variety of reasons, both innocent and evil:

How can this be prevented? Relatively easily using some quick .htaccess directives.

The Code

The following prevents any domain beside yours from hotlinking:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www.)?yourwebdomain.com(/)?.*$ [NC]

The following allows only a friend to hotlink — everyone else is barred:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www.)?yourwebdomain.com(/)?.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www.)?friend1domain.com(/)?.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www.)?friend2domain.com(/)?.*$ [NC]

The following allows for protection of only specified file extensions:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www.)?yourwebdomain.com(/)?.*$ [NC]
RewriteRule .*.(gif|jpe?g)$ [F,NC]

The following returns a “stop stealing my images” image:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www.)?yourwebdomain.com(/)?.*$ [NC]
RewriteRule .(gif|jpe?g|png|bmp)$ /graphics/stop-stealing.jpg [L,NC]

You can use the above coding practices to prevents thievery of any type of file you’d like, including CSS, JavaScript, and text files.