Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How to prevent hot linking (“image theft” / “bandwidth theft”) of ressources on my site?

I'd like to forbit image linking on my server. That means if someone tries to link from another server to an image of my server, he should not see the linked image but an alternative image (an image with a writing: "image linking is forbitten!").
Unfortunately it doesn't work at all: Either the original image is shown at the remote server, or the forbitten-image is even shown on my own server, although I never invoke my images with full URL:

Options -Indexes 
RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^*$ [NC]
RewriteRule .*\.(png|PNG)$ [R]

If I make this so, I always get the linkingpicsforbitten.png image, even on my own server although I invoke my pictures like this:

<img class="pictures" src="drawings/myoriginalpic.png" alt="original pic" style="width:640px; height:466px;"/>

So what's wrong here?

share|improve this question

marked as duplicate by mailq, Shane Madden, RobM, ceejayoz, Ward Nov 6 '11 at 3:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 0 down vote accepted

I suspect that the Referer is not match, so you should record the rewriting actions with RewriteLog or use Firebug to verify the HTTP referer.

Try something like this:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?my-domain\.net/.*$ [NC]
RewriteRule .*\.(gif|jpe?g|png)$ [R,NC,L]
share|improve this answer
The problem is the same. I want to redirect to the forbitten image, if and only if the referer contains http://.... So in my opinion, I have to leave the "!" but then redirection to the forbitten image doesn't work from remote, and it has no effect on my own server (which should be the right behaviour in this case). I wasn't able to log that yet, because I always get "RewriteLog not allowed here" in the error log. And firebug doesn't show me the referer of the images. At least I don't know how to do that. I only get the referers from the html sites. – Bevor Nov 6 '11 at 9:19
Ok now I understand why I need !^ I have to redirect all requests which are not, so the "!" should be right. But it doesn't explain why it still doesn't work. – Bevor Nov 6 '11 at 9:25
Logging the referer lead to success, it finally works. It was a mistake to write It should have been because the referer points to the html file which is in this directory. – Bevor Nov 6 '11 at 9:34

If I understand your rules, you do:

  • if the referer is not empty AND
  • if the referer is not like "*$ [NC]"

... I would do:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !en/pictures/drawings/ [NC]
RewriteRule .*\.(png|PNG)$ [R,L]

NB: the second rewrite rule just means "if the referer doesn't contain "en/pictures/drawings/", which should be enough for you and which still may work if you use https one day.

Don't forget the "L" in the RewriteRule, to stop going further. Unless you really need to do a redirect, you may just do this RewriteRule instead:

RewriteRule .*\.(png|PNG)$ /pics/linkingpicsforbitten.png [L]

Because what you do is a redirect. And a redirect means new exchange. With the previous rule, you won't have this. There won't be an extra (and useless) exchange between the client (which will get a redirect so re-ask for the new picture) and the server (which will get another request for the rewritten picture (the "forbidden picture").

To summarize:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !en/pictures/drawings/ [NC]
RewriteRule .*\.(png|PNG)$ /pics/linkingpicsforbitten.png [L]

This is shorter, more efficient, and clearer.

Hope this helps.

share|improve this answer
With this rule I get always the forbitten image, remote and on own server. Moreover it doesn't make sense to me because en/pictures/drawings/ always appears in an url. You had to check for http://... in the referer to find out if the picture is linked from remote, but when I do that with or without negotiation (shouldn't it be RewriteCond %{HTTP_REFERER} ^*$ [NC] without "!" then?) I always get the forbitten or I never get the forbitten. It doesn't make sense to me. – Bevor Nov 6 '11 at 8:51
I understand now what you mean. But I don't understand why it doesn't work, hmmm. – Bevor Nov 6 '11 at 9:29
It finally works. It was a mistake to write It should have been because the referer points to the html file which is in this directory. – Bevor Nov 6 '11 at 9:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.