I am trying to set up my hotlink protection for my website. However, I stumbled upon articles which are suggesting slightly different answers and due to the fact that I am not very familiar with Apache directives I decided to post this question here.
This is one of the codes that it seems most of the articles are using:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://example.com/nohotlinking.jpg [NC,R,L
1) However, some of the articles had RewriteCond %{HTTP_REFERER} !^$ but some did not. Could you please explain what exactly this line do and is it better to have it or not?
2) Furthermore, in regard to the last line of code I notice two different approaches one
RewriteRule \.(jpg|jpeg|png|gif)$ http://example.com/nohotlinking.jpg [NC,R,L]
and the other
RewriteRule .*\.(jpg|jpeg|png|gif)$ http://example.com/nohotlinking.jpg [NC,R,L]
what would be the difference if I include the ".*" and once again which one would you recommend to use.
3) Thirdly, I was wondering if there is a way to add all file extensions to this rule automatically and would this be a good idea?
4) Lastly, would this method create any problems when sharing an article on social media platforms or for the overall SEO performance of the website?
Thank you very much in advance!
Best regards, George
1) However, some of the articles had RewriteCond %{HTTP_REFERER} !^$ but some did not. Could you please explain what exactly this line do and is it better to have it or not?
If you looked into this a bit already, then you have probably come accross the info already, that the referrer is pretty unreliable.
It could be “faked”, or completely blocked - some browser privacy extensions or personal firewalls do this, for example.
The condition !^$ matches if the referrer is not empty. So in combination with the rest, access will still be allowed, if the client sends an empty referrer, resp. that request header is not set at all. If it sends a referrer from a different domain than those you explicitly allow, or the referrer would instead contain anything such as Blocked by Extension XYZ for Privacy Reasons, then access would still get blocked.
2) Furthermore, in regard to the last line of code I notice two different approaches one
RewriteRule \.(jpg|jpeg|png|gif)$ http://example.com/nohotlinking.jpg [NC,R,L]and the other
RewriteRule .*\.(jpg|jpeg|png|gif)$ http://example.com/nohotlinking.jpg [NC,R,L]what would be the difference if I include the ".*" and once again which one would you recommend to use.
Since both patterns are only anchored at the end, they allow any arbitrary characters before them.
The first pattern says, match any request that ends with .jpg (and all the other listed extensions, of course), whereas the second one matches any request ending with *.jpg. (* used in a glob syntax meaning here, not the regular expression meaning.)
So the difference here is rather “philosophical” in nature, the end effect is pretty much the same.
3) Thirdly, I was wondering if there is a way to add all file extensions to this rule automatically and would this be a good idea?
You can get as generic with your regex pattern there, as you want. RewriteRule .* https://… to match absolutely anything, for example.
But that is not a good idea. Your HTML documents themselves, likely get linked to from other sites as well – like a search engine result page. In that case, the referrer would usually be that other site - but you don’t want to block access to your HTML pages in this situation now, right?
4) Lastly, would this method create any problems when sharing an article on social media platforms or for the overall SEO performance of the website?
It can create problems, for example when the platform tries to request an image to use as thumbnail for a link you share. The scrapers these social networks use, usually don’t send your domain as referrer - but I don’t think they have much reason to send any different one then either, so likely the referrer would just be empty, and then the condition discussed under 1) would have this covered.
These scrapers usually send specific a specific User-Agent header though - so that further exceptions can be added, based on that, if necessary.