Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a gallery with pictures. If anybody links my gallery pictures from somewhere else (remote server), a forbitten image should be shown. This basically works, but now I recognized a strange behaviour with my rewrite rule. Here is the rule:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^$ 
RewriteCond %{HTTP_REFERER} !^*$ [NC]   
RewriteRule .*\.(png|PNG)$ [R,L]

What exactly happens: The gallery consists of shtml pages which links the pictures with relative paths and I can browse the pictures with back and forward. This works, every picture is shown. When I invoke the page on the evil remote server, which links a picture of my gallery, the remote server gets the forbitten image which is the wanted effect, but now something strange happens: Back on my own server, when I browse in my picture gallery to the picture which has been invoked by the evil remote server, I suddendly get the forbitten image there too, even in my gallery. When I hit F5 to reload the gallery, the picture works again. But this is not acceptable.
What can I do? I tried to change and combine or leave the flags of the RewriteRule but nothing can help. The only acceptable solution would be to set the [F] flag. In this case the evil remote server doesn't see the forbitten image but a blank page but at least my gallery works every time. But I'd rather want the forbitten image to be working. Any ideas?

share|improve this question
up vote 2 down vote accepted

The forbidden image is being cached in your web browser. You need to use mod_headers to set it to never cache.


<FilesMatch "linkingpicsforbitten\.png$">
<IfModule mod_headers.c>
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
Header set Pragma "no-cache"
Header set Expires "Wed, 11 Jan 1984 05:00:00 GMT"
share|improve this answer
Thanks. Works perfect. – Bevor Nov 6 '11 at 12:07

I believe your browser is just caching the forbidden image. You should be able to use mod_expires to enforce a no-caching policy on just your forbidden image.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.