Where do I put the .htaccess if I want to prevent bandwidth stealing?

[Erwin]

Put the .htaccess in the highest directory where you want to protect the files in that directory and its sub-directories - so put it in root if you want ALL subdirectories to be affected, or in /images if you want all subdirectories in /images to be affected.

Best to do this in SSH rather than FTP as some FTP programs cannot see .htaccess files.