Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to block hotlinking of PDF files on a site. Previously, I have used this method to block hotlinking for zip files on a different server. Here's my .htaccess:

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?*$ [NC]
RewriteRule \.(pdf)$ - [F,NC]

It is nearly identical code to the other site I use it on, except that I have "zip" in place of "pdf". For some reason, on this apache server it's blocking not just pdfs, but everything. PHP and HTML files accessed through the browser are giving the forbidden error. Can anyone see something I am missing in this block or have any ideas what might be causing this?

share|improve this question
similar question:… – pQd Jun 8 '09 at 18:14
Unlike the user in that question, my client is on shared hosting where I can ONLY use a .htaccess file. Also, I WANT to show a forbidden error. Mostly, I think a server setting or some sort of other error is screwing up the working rewrite. – Mesidin Jun 8 '09 at 18:28
up vote 1 down vote accepted

Diagnostic: what happens if you put up a .htaccess containing only RewriteEngine on? What we're checking for there is whether there are wacky server-defined rules that someone left lying around, relying on RewriteEngine being off to disable them.

Comments show this is the case. Awesome. The only thing I can think of to tell you to try is solutions that don't use mod_rewrite, like:

SetEnvIf Referer . hotlink=1
SetEnvIfNoCase Referer ^http://(www\.)?domain\.com/.*$ !hotlink
<LocationMatch *.pdf>
    Order allow,deny
    Deny from env=hotlink
    Allow from all
share|improve this answer
1. That's my entire file. 2. If I remove the .htaccess or upload a blank version, everything works fine. You can access all the files on the system. Thanks for the help! – Mesidin Jun 8 '09 at 18:09
Well, I put that on there in place of my original, but it's not redirecting. It's still giving a forbidden return. – Mesidin Jun 8 '09 at 19:16
Okay, I tried with just "RewriteEngine on" as well. It's the same thing. ALL files become forbidden. – Mesidin Jun 8 '09 at 19:21
Ha. You were right, then, it is server config. Either someone's incompetent and some global-forbid rule sitting around, or that's their way of denying you the use of mod_rewrite (God knows why). Unfortunately, I can't think of any way around it, if ddrager's rule with [L] in it didn't work. Of course, you could call them up and ask them wtf the deal is. – chaos Jun 8 '09 at 19:30
Thanks! Stupid shared hosting. ;) – Mesidin Jun 8 '09 at 19:39


RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?domain\.com/.*$ [NC]
RewriteRule .*\.pdf$ - [F,L]
share|improve this answer
Unfortunately, that did not work either. Same problem of getting a forbidden error even on valid referred requests and on non-pdf files. It's blocking everything, so I am guessing this is some sort of server setting and not the .htaccess file itself? – Mesidin Jun 8 '09 at 18:18

Try this, on my server works prefectly:

#Enables mod_rewrite, otherwise all Rewrite directives below will not work
RewriteEngine on

#Hotlink protection
RewriteCond %{HTTP_REFERER} !^*$      [NC]
RewriteCond %{HTTP_REFERER} !^$      [NC]
RewriteCond %{HTTP_REFERER} !^*$      [NC]
RewriteCond %{HTTP_REFERER} !^$      [NC]
RewriteRule .*\.(pdf|zip)$ - [F,NC]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.