Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

in all my Apache servers I use hotlink protection because I hate the idea someone could stick my images/flash in their sites using my server bandwidth.

In order to make hotlink protection work, in my Apache .htaccess I simply use this:

#Hotlink protection (only for cause is being redirected)
RewriteCond %{HTTP_REFERER} !^*$      [NC]
RewriteCond %{HTTP_REFERER} !^$      [NC]
RewriteRule .*\.(wav|swf|jpg|jpeg|gif|png|bmp|js)$ - [F,NC]

This works well, but I recently dicovered that when I ask for (with final slash) the hotlink protection seems to be triggered and server stops page to download .(wav|swf|jpg|jpeg|gif|png|bmp|js) files

Do you know how could I fix this in .htaccess???

Before today I even thought that the server should return an error if I enter as URL (with final slash). But I saw it's normal because if you look for it returns the same page of (final slash). Why is that, could you explain me a bit?!


share|improve this question
Related:… – Andrew Nov 3 '10 at 23:23
I haven't even looked at your issue, but to simplify your rules you can trivially rewrite that condition as one regex: !^http://www\.domain\.it(/.*)?$ – jgoldschrafe Nov 4 '10 at 2:22

1 Answer 1

Are you sure it's the hotlink protection? If your website is laid out something like this:


Then if somepage.htm has relative paths to the image like <img src="images/a.jpg"> and you go to, then your web browser will think it's in the "somepage.htm" directory and try to load the image Apache will probably send you another copy of somepage.htm if you go there, which will cause your browser to show a broken image.

I'm not sure if Apache has a setting to turn this off. It doesn't make much sense on plain HTML files but the reason Apache (and other servers) allow this is for sites that use "pretty URLs" (like serverfault's URLs!) where the URL extends past the actual file. There isn't a file on serverfault called "urls-with-final-slash-trigger-hotlink-protection-on-my-server", that's just there for people (and Google) to read. You can load this question just fine with

While I don't know how serverfault was made (there are many ways to do this) it's almost certain that there's no file named "197935" either. It's possible that there's a script named "questions" though, and the server could run that script, and the script would see the entire URL, look up the number in the database, and make this page.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.