Do I need to explicitly add every search engine & social media...
Potentially, yes. However, it does depend on how the third party (search engine / social media platform) fetches/caches your images.
If Google image search is a concern then you will need to punch a hole in your hotlinking protection to allow google.com
as the Referer
. Whilst googlebot will be able to crawl your images initially (because of your first condition that checks for an empty Referer
), when a user clicks on an image in "image search", a direct request is made to your site, which sends a Referer
of the form https://www.google.com/
.
RewriteCond %{HTTP_REFERER} !^http?://([^.]+\.)?google\. [NC]
Rather importantly, you are missing the s
in https
in the above regex, so this negated condition will always succeed and https://www.google.com
will be blocked. Google is HTTPS everywhere these days, so you don't need the ?
for an optional s
. I don't think you need the NC
flag either (only malformed bots send uppercase Host
headers):
RewriteCond %{HTTP_REFERER} !^https://([^.]+\.)?google\.
Aside: I have seen http://www.google.com
(note HTTP, not HTTPS) used as the Referer
by malicious bots, so if anything, these should be blocked.
Or, is there any better way to protect images from hotlinking?
There is no other way. By its very nature, it is unreliable and prone to error.
You should probably only implement hotlinking prevention if it becomes a problem for your site, hampering your site performance or consuming all your bandwidth (or maybe they hotlink everything!). It can even benefit you SEO-wise. I would rather a site hotlinked a few of my images (which I still control), rather than copy and reuse my images without attribution (which I have no control over).