Hotlink protection

  • Resolved sandy78

    (@sandy78)


    10 years, 8 months ago

    I want to block the hotlinking to images in my site, and what I should do?
    To edit the secure .htaccess file including my URL in the place “add-your-domain-here” in the bulletproof code of my .htaccess file:

    # BLOCK HOTLINKING TO IMAGES
# To Test that your Hotlinking protection is working visit http://altlab.com/htaccess_tutorial.html
#RewriteEngine On
#RewriteCond %{HTTP_REFERER} !^https?://(www\.)?add-your-domain-here\.com [NC]
#RewriteCond %{HTTP_REFERER} !^$
#RewriteRule .*\.(jpeg|jpg|gif|bmp|png)$ - [F]

    , or I should have to use the custom code option?

    http://wordpress.org/plugins/bulletproof-security/

Viewing 8 replies - 1 through 8 (of 8 total)
  • Plugin Author AITpro

    (@aitpro)

    10 years, 8 months ago

    Yes, you would add this to BPS Custom Code so that it is saved permanently and will be written to the root .htaccess file if you use AutoMagic again at a later time.

    1. Add this code and any other blocking or redirect custom .htaccess code to this Custom Code text box: CUSTOM CODE BOTTOM HOTLINKING/FORBID COMMENT SPAMMERS/BLOCK BOTS/BLOCK IP/REDIRECT CODE: Add miscellaneous code here

    2. Click the Save Root Custom Code button.

    3. Go to the Security Modes page, click the Create secure.htaccess File AutoMagic button and activate root folder BulletProof Mode again.

    Plugin Author AITpro

    (@aitpro)

    10 years, 8 months ago

    Here is a more modern way to block image theft/HotLinking. Replace the ait-pro.com domain and Server IP Address with your actual domain and Server IP Address.

    BUT keep in mind that there is an advantage to having your images show up in Google, Yahoo, Bing images. 😉 I assume you can whitelist this, but have not played around with this yet.

    SetEnvIfNoCase Referer "^http://www\.ait-pro\.com$" whitelist
SetEnvIf Server_Addr "^173\.201\.92\.1$" whitelist

<FilesMatch "\.(gif|jpg|jpeg|png|bmp)$">
Order Allow,Deny
Allow from env=whitelist
</FilesMatch>
    Plugin Author AITpro

    (@aitpro)

    10 years, 8 months ago

    Ok played around with this and this works. Google, Yahoo and Bing are not blocked from retrieving your images.

    SetEnvIfNoCase Referer "^http://www\.ait-pro\.com$" whitelist
SetEnvIfNoCase Referer "^http://.*google.*" whitelist
SetEnvIfNoCase Referer "^http://.*yahoo.*" whitelist
SetEnvIfNoCase Referer "^http://.*bing.*" whitelist
SetEnvIf Server_Addr "^173\.201\.92\.1$" whitelist

<FilesMatch "\.(gif|jpg|jpeg|png|bmp)$">
Order Allow,Deny
Allow from env=whitelist
</FilesMatch>

    And I guess to be on the safeside regarding http/https then this would be better to use just in case. Not really sure if it necessary or not, but it doesn’t hurt to include it.

    SetEnvIfNoCase Referer "^http://www\.ait-pro\.com$" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*google.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*yahoo.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*bing.*" whitelist
SetEnvIf Server_Addr "^173\.201\.92\.1$" whitelist

<FilesMatch "\.(gif|jpg|jpeg|png|bmp)$">
Order Allow,Deny
Allow from env=whitelist
</FilesMatch>
    Thread Starter sandy78

    (@sandy78)

    10 years, 8 months ago

    Thank you,
    My site has a SSL certificate, I mean I have the site in http and https so.. should the code be like this??

    SetEnvIfNoCase Referer "^(http|https)://www\.ait-pro\.com$" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*google.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*yahoo.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*bing.*" whitelist
SetEnvIf Server_Addr "^173\.201\.92\.1$" whitelist

<FilesMatch "\.(gif|jpg|jpeg|png|bmp)$">
Order Allow,Deny
Allow from env=whitelist
</FilesMatch>
    Plugin Author AITpro

    (@aitpro)

    10 years, 8 months ago

    Yep, you got it. 😉 And that works out nicely for both http and https sections/areas/pages/etc of your site.

    Plugin Author AITpro

    (@aitpro)

    10 years, 8 months ago

    And you probably already have your SSL .htaccess code, but if you don’t then take a look at this Forum link: http://forum.ait-pro.com/forums/topic/wordpress-ssl-htaccess-code-rewrite-ssl-rewritecond-server_port/#post-7291

    Plugin Author AITpro

    (@aitpro)

    10 years, 8 months ago

    Resolving.

    Thread Starter sandy78

    (@sandy78)

    10 years, 8 months ago

    Sorry I could answer before.

    No I don’t know if have SSL .htaccess code. I have wordpress in https and the site in http but also if you want you can see it in https. but I did nothing with the .htaccess. My .htaccess file works good, your plugin works good so I don’t know If I have to have some SSL .htacces code…

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Hotlink protection’ is closed to new replies.