Board Optimization - Complete Hotlink Protection

Title : Complete Hotlink Protection

Version : 1.1

Coder : naveeid
Purpose : Prevent your forum attachments from being directly linked to - prevent bandwidth abuse.

Why : My dedicated server was down due to too many hotlinked image connections. i was feeling helpless. even after protecting images through .htaccess, images were still hot linked through attachment.php



How : just edit your server .htaccess and modify the code with your domain names



Installation :
edit your .htaccess file.

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourfirstwebsite\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yoursecondwebsite\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ http://www.yourfirstwebsite/anypic.jpg [L]


RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourfirstwebsite\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*attachment\.php*$ http://www.yourfirstwebsite/anypic.jpg [L,R,NC]

1) please change yourfirstwebsite.com and yoursecondwebsite.com to your websites on that cpanel account. if you dont have a second website then you can remove that line

2) i am allowing google to fetch images or attachments for their server. if you dont want to allow google then just remove that line.

3) replace anypic.jpg with your website banner or hotlink warning banner.

it works very fine. its the simplest and easiest available soloution.

Demo:-
i have installed it on my website , you can check my website for hotlink protection.
http://www.nidokidos.org/attachment....3&d=1302073196
now this image will show in my website , this image will be displayed if opened it in a browser. but if it will be opened in any other website , it will be replaced by my website banner.

[billstelling]

Originally Posted by naveeid

you have not placed any image at anypic.jpg????? please check that.

yea i did.. i just named the pic that..

[naveeid]

Originally Posted by Boofo

What do you think vb considers someone who isn't logged in, no matter where they are? I'm saying they attachment.php code doesn't need to be there as you have to be logged in to be able to download and see attachments, anyway. Thus, redundant code.

if some one is not logging in but visits our website , he is a guest member. you can control guest permissions from the admin panel.

but if some one uses my website resources , hotlink my images in emails , sent it to large yahoo groups , place my website hotlinked images in forums , there is no option in VB4 to control that kind of hotlinking. and there was no modification available to stop the abuse of attachment.php. in this mod you can stop this kind of hotlinking. and save your server resources.

[naveeid]

Originally Posted by billstelling

yea i did.. i just named the pic that..

so i hope its working fine ?

[Boofo]

Originally Posted by naveeid

if some one is not logging in but visits our website , he is a guest member. you can control guest permissions from the admin panel.

but if some one uses my website resources , hotlink my images in emails , sent it to large yahoo groups , place my website hotlinked images in forums , there is no option in VB4 to control that kind of hotlinking. and there was no modification available to stop the abuse of attachment.php. in this mod you can stop this kind of hotlinking. and save your server resources.

Well, you are wrong. I just tested in on the com with an attachment.php link from my site. If I was logged into my site at the same time, then, yes, the link would show the actual attachment. But if I was logged out of my site and clicked on the link that I posted on the com, it showed the registration error page from my site when I clicked on that link. So, your attachment.php code is ONLY good if the person is also logged into the site they are using it from, or if you allow guests to view and download attachments.

If you have the replacement image for the hotlinking on your site, the resources should be the same on your server as it still has to retrieve the image from your server.

[naveeid]

boofo may be i am unable to explain my point of view correctly to you..

let me explain it again.

1) first of all this mods stops simple hotlinking. and if some one hotlinks your images , it replaces it with your website banner or warning message.

2) secondly if my website images are placed and hotlinked using attachment.php then if will not show the original image but it will show website banner or warning message.

for example this is an image hosted on my website.
http://www.nidokidos.org/attachment....1&d=1298731742

a- if you will try to open it as its , it will be replaced by nidokidos banner.
a- if you will see it in google images , it will work fine.
b- if anyone , guest or member will see this image on nidokidos website pages , it will work fine.
for example see this image posted on this page.
but

if it is hotlinked in "any other" website , it will show a banner or warning message.

now see a website has placed it on it page , (may be using bing) , and as i have not allowed that website or bing to show my image on their web pages , they are getting a banner from my webserver.

please see this link
http://connect.in.com/nidokidos-org/...527553176.html


this is for what i made this mod. i hope you understand it now.
it has nothing to do with registrations , / members / guest.

[donal]

Where this file should actually be placed. Suppose I have www.mysite.com as domain and www.mysite/forum as forum root.

Should I place it in domain or in forum root directory?

[naveeid]

you have to add it in your /forum directory.

[Boofo]

I added it to the root and it works fine from there for me.

[naveeid]

ok good.

[viper357]

Does this work in vb3? I've put this at the bottom of my htaccess file but it doesn't seem to work, can someone check it for me please? My website is in my signature. Thanks.

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^http://(.+\.)?marineaquariumsa\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?bing\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ http://www.marineaquariumsa.com/hotpic.jpg [L]


RewriteCond %{HTTP_REFERER} !^http://(.+\.)?marineaquariumsa\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?bing\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*attachment\.php*$ http://www.marineaquariumsa.com/hotpic.jpg [L,R,NC]