How to prevent hotlinking for specific domains using .htaccess?

Question

I'm being heavily spammed by image scraper sites. There are more than 150+ domains targeting my images & sending spammed links to my site. I just want to prevent hotlinking from them. I just want to block only those specific sites.

Is there any htaccess rule for preventing hotlinking in specific sites only and allow others which is not included in list?

Answer 1

Using https://www.htaccesstools.com/hotlink-protection/

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

You may or may not need RewriteEngine on. The next line allows a blank referrer. You may need to examine your log files and may optionally remove this line.

The last two lines are the meat of the code. Change example.com to your domain name. As well, if you want to add or remove more image types, you can simply add them or remove them. Please not the | character is an or character. You need these in your list just as you see them. In this case, jpg or jpeg or png or gif.

You can certainly use the link above to do this for you.

Answer 2

There are more than 150+ domains targeting my images & sending spammed links to my site. I just want to prevent hotlinking from them. I just want to block only those specific sites.

"150" is a little excessive to block specifically and this may become hard to maintain in the future. It would be more usual to block all hotlinking sites as in @closetnoc's answer, and just allow specific Referers as required.

However, to answer your question, if you want to block just those specific Referers then you would need something like the following.

RewriteEngine On

RewriteCond %{HTTP_REFERER} ^https?://referer-1\.example/ [OR]
RewriteCond %{HTTP_REFERER} ^https?://referer-2\.example/ [OR]
# etc...
RewriteCond %{HTTP_REFERER} ^https?://referer-150\.example/
RewriteRule \.(jpe?g|png|gif)$ - [NC,F]

This would need to go at the top of your .htaccess file.

There should be no OR flag on the last condition, otherwise all traffic will be blocked.

The L flag is not required on the RewriteRule directive when using the F flag, it is implied.

UPDATE: To make the above more efficient you should still first include the conditions that check that the Referer is not the expected hostname (and optionally is not blank) - as in @closetnoc's answer - so that the rule fails early for 99.9% of requests.

For example:

RewriteEngine On

# Fail early for all "direct" and "internal" requests
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?example\.com

# Block specific Referers...
RewriteCond %{HTTP_REFERER} ^https?://referer-1\.example/ [OR]
RewriteCond %{HTTP_REFERER} ^https?://referer-2\.example/ [OR]
# etc...
RewriteCond %{HTTP_REFERER} ^https?://referer-150\.example/
RewriteRule \.(jpe?g|png|gif)$ - [NC,F]