I would not depend on the referrer.
The easiest way is to make a set of rules with IP addresses you want blacklisted as well as user agents you want blacklisted and if a remote user matches any of the blacklists, then they will receive the not-authorized page. Below is a template you can use. replace the set of three x's with digits for the IP address and the slashes are next to the dots to make them literal. Also, change secretmp3folder
to the folder where your MP3's are stored.
RewriteEngine On
RewriteCond %{REMOTE_ADDR} xxx\.xxx\.xxx\.xxx [OR]
RewriteCond %{REMOTE_ADDR} xxx\.xxx\.xxx\.xxx [OR]
...
RewriteCond %{REMOTE_ADDR} xxx\.xxx\.xxx\.xxx [OR]
RewriteCond %{REMOTE_ADDR} xxx\.xxx\.xxx\.xxx
RewriteRule ^/secretmp3folder/(.*)$ - [R=403,L]
RewriteCond %{HTTP_USER_AGENT} ^badagent$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^terribleagent$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^insaneagent$
RewriteRule ^/secretmp3folder/(.*)$ - [R=403,L]
Another thing you can do is when advertising the download, make the link to it a special page that sets a cookie then redirects the user to the download.
Here's an example. (keep in mind I'm excluding common HTTP headers and I'm only showing content within the body tags)
The advertisement page:
<p>Download any of these songs</p>
<a href="download.php?mp3=song1.mp3">Song 1</a><br>
<a href="download.php?mp3=song2.mp3">Song 2</a><br>
The download.php script the links link to:
<?php
if (intval($_GET['DOWNLOAD']) != 1){
$file=$_GET["mp3"];
setcookie("candownload",1,time()+86400,"/","example.com");
header("HTTP/1.1 301 Moved",true);
header("Location: http://example.com/path/to/download.php?mp3=".$_GET["mp3"]."&DOWNLOAD=1",true);
}else{
if (intval($_COOKIE["candownload"]) != 1){
echo "Access denied";
}else{
header("content-type: application/ms-download",true);
header("content-disposition: attachment; filename=".$_GET["mp3"],true);
echo file_get_contents("/path/to/".$_GET["mp3"]);
}
}
?>
The script isn't 100% perfect since some things needs tweaking depending on where the MP3 files are on your system. But the idea is when someone clicks a downloadable MP3 file, they are taken to a redirect page and at the same time a cookie is stored on the clients computer to identify them as a client. then after the redirect, the client is validated as a client and the download immediately begins.