6

I have a working hotlinking prevention in the .htaccess. Everything works fine. However, I use an image of my website in email signature. After the hotlinking prevention, this image is now displayed in old mails also with the placeholder image (the image that describes that hotlinking is not allowed). Since I can't change the code for old mails from customers etc. of course, I want to exclude the old signature image from the hotlinking prevention. What line of code do I need to add to do this? I have tried various things and somehow it does not work.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mywebsite.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?google.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?bing.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yahoo.com/.*$ [NC]
RewriteRule \.(jpg|jpeg|png|gif|svg|webp)$ https://www.dropbox.com/s/XXXXXXXXX/stop-hotlinking.png?raw=1 [NC,R,L]

Which line do I have to insert if my old signature image behind the following address and should be excluded from hotlinking prevention? Just this one file only.

https://www.mywebsite.com/wp-content/uploads/old_signature.gif
6
  • Does really nobody know a solution?
    – dajana.s
    Aug 30, 2022 at 0:18
  • Am I perhaps in the wrong forum section?
    – dajana.s
    Sep 1, 2022 at 21:34
  • In my opinion, your question is basically a textbook example of what's on-topic for this Stack Exchange site. Unfortunately, we just don't get a lot of traffic here, so good questions remain unanswered sometimes. In my discretion, I've added a bounty to this post to help try to attract an answer. This will feature it under the "Bountied" tab of the home page for the next seven days. Hopefully you'll get an answer soon! Sep 2, 2022 at 4:32
  • @MaximillianLaumeister Oh thank you very much for your nice words and the "bounty" (never heard about that before). I am curious if anyone can help. Have a nice day!
    – dajana.s
    Sep 3, 2022 at 1:00
  • 1
    "Does really nobody know a solution?" - The question was lacking some general/relevant tags (it was only tagged "hotlinking") which I think is why I didn't see it initially.
    – MrWhite
    Sep 8, 2022 at 15:07

1 Answer 1

4
+50

To allow that specific file, excluding it from the hotlink-protection script you just need to add the following condition (RewriteCond directive) to the existing list of conditions:

RewriteCond %{REQUEST_URI} !=/wp-content/uploads/old_signature.gif

This checks that the requested URL-path (ie. the value of the REQUEST_URI server variable) is not (denoted by the ! prefix) the URL of the image you want to allow.

The ! prefix negates the expression, so it is successful when it does not match (as with all the other conditions on this rule).

The = prefix operator makes this a lexicographical string comparison, as opposed to a regex (the default). So, this is essentially an "exact match" and no need for anchors or additional character escaping (as would be required with a regex).

Requests for this image (this exact URL) are then allowed through unencumbered.

The complete code would then look like this:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mywebsite.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?google.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?bing.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yahoo.com/.*$ [NC]
RewriteCond %{REQUEST_URI} !=/wp-content/uploads/old_signature.gif
RewriteRule \.(jpg|jpeg|png|gif|svg|webp)$ https://www.dropbox.com/s/XXXXXXXXX/stop-hotlinking.png?raw=1 [NC,R,L]

Alternative - separate rule (exception)

Alternatively, if you don't have any other mod_rewrite rules in your .htaccess file that should apply to this request (unlikely) then you could instead add an additional rule (an exception) before the existing hotlink-protection script, at the very top of the .htaccess file.

For example:

# Prevent further processing if this file is requested
RewriteRule ^wp-content/uploads/old_signature\.gif$ - [L]

# Existing hotlink-protection script follows...
:

Note that this "alternative" solution assumes the .htaccess file is located in the document root, not a subdirectory.

6
  • I tried it, but it does not work, unfortunately. I added RewriteCond %{REQUEST_URI} !=/wp-content/uploads/old_signature.gif at the right place in the code. But it does not work. Then I tried to change the URL to the exampledomain.com/wp-content/uploads/old_signature.gif So I tried both versions: RewriteCond %{REQUEST_URI} !=/wp-content/uploads/old_signature.gif AND RewriteCond %{REQUEST_URI} !=exampledomain.com/wp-content/uploads/old_signature.gif but that does not work as well. PS: I don't know why paragraphs don't work in my comment.
    – dajana.s
    Sep 9, 2022 at 19:47
  • @dajana.s Where is this .htaccess file? What other directives do you have in this file? Do you have any other .htaccess files in subdirectories along the filesystem path? By "does not work" you presumably mean that you are redirected and the requested image is not displayed? That should not happen, even with your original script, when you make a direct request as you suggest (ie. by typing the URL into the browser's address bar, which I assume is what you mean by "change the URL to"?) since the Referer header will be empty and your first condition excludes this.
    – MrWhite
    Sep 9, 2022 at 23:53
  • @dajana.s "So I tried both versions" - where did you get the second version from? Your second version is certainly "wrong" as it will always be successful. The REQUEST_URI server variable contains the URL-path only.
    – MrWhite
    Sep 9, 2022 at 23:56
  • @dajana.s Did you try the "alternative" (second) solution in my answer?
    – MrWhite
    Sep 9, 2022 at 23:58
  • The Htaccess file is in the same folder where the "wp-content" folder is located. The Htaccess works fine, I use for many years in this location. Hotlinking prevention works fine too, only the exception described here for a specific file does not work. "Does not work" means that instead of the file to be excluded, the hotlinking image is displayed anyway (a stop sign). My 2nd version was just an attempt by me. I didn't try your alternative, because the Htaccess contains of course other mod_rewrite rules (it is the typical wordpress htaccess file).
    – dajana.s
    Sep 10, 2022 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.