Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this in my htaccess at the public_html folder of my file server:

RewriteEngine On
RewriteBase /
ReWriteCond %{REQUEST_URI} ^/files/*
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?*$ [NC]
RewriteRule \.(gif|png|jpg|jar|sis|mp3|thm)$ - [F]

And I have lots of folders and files inside the dir, which I want to prevent from being direct-downloaded from sites other than However the above rules don't seem to work despite I know that .htaccess file is enabled. In some cases it only blocks the images but no the files. Please tell me what's wrong with that script, or if I can use any other directive to prevent external sites from leeching my files constantly. Thanks

share|improve this question
See my edited answer. – Dennis Williamson Sep 26 '09 at 3:56

Does it help if you add ".*"?

RewriteRule .*\.(gif|png|jpg|jar|sis|mp3|thm)$ - [F]

Also, your line:

ReWriteCond %{REQUEST_URI} ^/files/*

means (at the end) "a slash zero or more times". You might try:

ReWriteCond %{REQUEST_URI} ^/files/.*

which means "a slash then any character zero or more times".

Edit: Some of your files may be named with uppercase extensions. You might try:

RewriteRule .*\.(gif|png|jpg|jar|sis|mp3|thm)$ - [F,NC]
share|improve this answer
No, that didn't solve the problem, it seems there's something else wrong in that config. :( – Andrew Sep 26 '09 at 1:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.