Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to prevent people hotlinking to PDF AND DOC files. Usually, i would approach this with a .htaccess rule like this:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?*$ [NC]
RewriteRule \.(pdf|doc)$ /home/ [R=302,L]

However, many of these files are linked to through php scripts like filedownload.php?id=5 which then trigger the download of a PDF/DOC file. Is there a way to prevent hotlinking to these files via the mime of the outputted file? another way?

edit - added this source to show how files are called:

header("Pragma: public"); 
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false);
header("Content-Type: $ctype");
header("Content-Disposition: attachment; filename=\"".basename($fn)."\";" );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".$fs);
echo $upload["file_contents"];
share|improve this question
How are the files triggered by the PHP? Can you add the relevant bits of the PHP to the question? – markdrayton Sep 9 '09 at 12:11
added more content above – seengee Sep 9 '09 at 13:26
up vote 1 down vote accepted

I think your rewrite rule isn't going to know what the mime type of the file is since none of the code for the response will have been executed at that stage. I think the best alternative in this circumstance would be to add a referrer check inside of your php code and redirect from there if the referrer isn't from your domain.

share|improve this answer
yep, thats exactly what we've ended up doing. we were just hoping there might be a more global solution without modifying individual files. – seengee Sep 9 '09 at 14:12
If you're passing the file name into the php script with a get parameter then you could maybe make a rewrite rule to look at that file name. – Hans Lawrenz Sep 9 '09 at 14:36
@hrwl will give you the credit since that is the solution we came to independently – seengee Sep 11 '09 at 14:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.