Skip to main content

Preventing Image Bandwidth Theft With .htaccess (thesitewizar...

Popularity Report

Total Popularity Score: 0

Loading...
Loading...
Loading...
Loading...
Loading...
Loading...

Rank

Bookmark History

Saved by 18 people (-9 private), first by anonymouse user on 2006-03-02


Public Sticky notes

The solution outlined in this article requires your site to be hosted on a machine using the Apache web server and that your web host allows you to override the server's configuration using a .htaccess file. For the more technically inclined, it uses the facilities provided in the mod_setenvif Apache module.

Highlighted by pklausner

Steps to Take

Protecting your images using a .htaccess file is trivial.

  1. Put all the images you wish to protect from being stolen (bandwidth-wise) in a separate directory.

  2. Create an ASCII text file named .htaccess and save it in that directory. Note that the name starts with a fullstop (or period) and is entirely in small letters (ie, lowercase). Cut and paste (unless you're using IE 6 in which case you just have to type it yourself) the following lines into that file:

    SetEnvIfNoCase Referer "^http://www.your-domain-name-here.com/" locally_linked=1
    SetEnvIfNoCase Referer "^http://www.your-domain-name-here.com$" locally_linked=1
    SetEnvIfNoCase Referer "^http://your-domain-name-here.com/" locally_linked=1
    SetEnvIfNoCase Referer "^http://your-domain-name-here.com$" locally_linked=1
    SetEnvIfNoCase Referer "^$" locally_linked=1
    <FilesMatch "\.(gif|png|jpe?g)$">
      Order Allow,Deny
      Allow from env=locally_linked
    </FilesMatch>
    

    Change "your-domain-name-here.com" to your real domain name. If your site can be accessed using other domain names (eg "www.your-domain-name-here.net"), be sure to add an additional SetEnvIfNoCase line for each of those domain names (with the URLs appropriately changed to the URLs of your domains. On the other hand, if your site can only be accessed using one domain, for example, using only "www.your-domain-name-here.com", then delete the line with "http://your-domain-name-here.com". The cut and paste code above caters to the usual case where most sites can be accessed with or without the "www" prefix.

    Do not correct my spelling in the code snippet given above. "Referer" (with only one "r" in the middle of the word) is the word that needs to go into the .htaccess file - do not change it to "Referrer".

Highlighted by stephanzr