Board Optimization - Complete Hotlink Protection

Title : Complete Hotlink Protection

Version : 1.1

Coder : naveeid
Purpose : Prevent your forum attachments from being directly linked to - prevent bandwidth abuse.

Why : My dedicated server was down due to too many hotlinked image connections. i was feeling helpless. even after protecting images through .htaccess, images were still hot linked through attachment.php



How : just edit your server .htaccess and modify the code with your domain names



Installation :
edit your .htaccess file.

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourfirstwebsite\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yoursecondwebsite\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ http://www.yourfirstwebsite/anypic.jpg [L]


RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourfirstwebsite\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*attachment\.php*$ http://www.yourfirstwebsite/anypic.jpg [L,R,NC]

1) please change yourfirstwebsite.com and yoursecondwebsite.com to your websites on that cpanel account. if you dont have a second website then you can remove that line

2) i am allowing google to fetch images or attachments for their server. if you dont want to allow google then just remove that line.

3) replace anypic.jpg with your website banner or hotlink warning banner.

it works very fine. its the simplest and easiest available soloution.

Demo:-
i have installed it on my website , you can check my website for hotlink protection.
http://www.nidokidos.org/attachment....3&d=1302073196
now this image will show in my website , this image will be displayed if opened it in a browser. but if it will be opened in any other website , it will be replaced by my website banner.

[Boofo]

Root.

[MissKalunji]

and if the image isn't available....

What will it show?

the standard vb error message?

[MissKalunji]

what if my attachement.php

is under a different folder?

[billstelling]

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter\.com/wordpress/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?bing\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ http://www.thewindowscenter.com/anypic.jpg [L]


RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?bing\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*attachment\.php*$ http://www.thewindowscenter.com/anypic.jpg [L,R,NC]

is that correct?

opps put the wordpress in the wrong spot.. fixed
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter.wordpress\.com/ [NC]

[Boofo]

naveeid, your attachment.php line does not work. I set guests to be able to download/view attachments, and this did not stop anyone from another site being able to hotlink it. When I set guests back to not be able to view or download attachments, then they got the login screen on a hotlink. But they got that anyway before the attachment.php line was added to the htaccess. So that code is redundant.

[naveeid]

@boofo
first of all this code is nothing to do with guests. this code is only to stop other sites from hotlinking images from vbulletin forum. as all the images are served through attachment.php in vbulletin , so we need to protect our attachment.php abuse.

if any other website or forum will place any images from my website , for example this image url
http://www.nidokidos.org/attachment....3&d=1304560281

which is serving image through attachment.php , using this code in htaccess will not let the images of your site being displayed on the other website , but it will replace your website banner.

so in a result they will remove your images from their website. the code is working perfectly fine with me.

[naveeid]

Originally Posted by MissKalunji

what if my attachement.php

is under a different folder?

it does not matter if the attachment.php is under any other folder.. it will work fine.

[naveeid]

Originally Posted by MissKalunji

and if the image isn't available....

What will it show?

the standard vb error message?

which image you are talking about , please explain your question so that i can give you the right answer.

[naveeid]

Originally Posted by billstelling

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter\.com/wordpress/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?bing\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ http://www.thewindowscenter.com/anypic.jpg [L]


RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?google\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?bing\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*attachment\.php*$ http://www.thewindowscenter.com/anypic.jpg [L,R,NC]

is that correct?

opps put the wordpress in the wrong spot.. fixed

RewriteCond %{HTTP_REFERER} !^http://(.+\.)?thewindowscenter.wordpress\.com/ [NC]

you have not placed any image at anypic.jpg????? please check that.

[Boofo]

Originally Posted by naveeid

@boofo
first of all this code is nothing to do with guests. this code is only to stop other sites from hotlinking images from vbulletin forum. as all the images are served through attachment.php in vbulletin , so we need to protect our attachment.php abuse.

if any other website or forum will place any images from my website , for example this image url
http://www.nidokidos.org/attachment....3&d=1304560281

which is serving image through attachment.php , using this code in htaccess will not let the images of your site being displayed on the other website , but it will replace your website banner.

so in a result they will remove your images from their website. the code is working perfectly fine with me.

What do you think vb considers someone who isn't logged in, no matter where they are? I'm saying they attachment.php code doesn't need to be there as you have to be logged in to be able to download and see attachments, anyway. Thus, redundant code.