I saw Google Images seems to index my images only if hotlink protection is off. [*]

I use anyway hotlink protection because I don't like the idea of people sucking my bandwidth, i simply use this code to protcet my images from being hotlinked:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mydomain\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mydomain\.com$ [NC]
RewriteRule .*\.(jpg|jpeg|png|gif)$ - [F,NC,L]

But in order to allow Google Image search to bypass my hotlink protection (I want Google Images search to show my images) would it suffice to add these lines:

RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?google\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?google\.com$ [NC]

Because I'm wondering:

  • are the images hotlinked just from www.google.com?
  • and what about google.it / google.co.uk, etc.?

FYI: on Google official guidelines I did not find info about this.

[*] I suppose hotlink protection prevents Google Images to show images in its results because I did some tests and it seems hotlink protection does prevent my images to be shown in Google Images search.


google.com, google.co.uk, etc. are different domains and, therefor, if you only allow one then the others will be blocked.

So you have two options. You could write out every Google variant (and Bing variant if you wanted images in their results too, and for other search engines) as conditionals - but that is quite impractical.

Another option is that you redirect all traffic that is attempting to access images from an external website to a server side script. In that script you can then do various things to check the referer (i.e. check that the referer includes Google at the start of the URL, etc.). If the referer is from an allowed domain, then the page would serve the image to the client using the appropriate header (e.g. header("Content-type: image/jpeg"); ) and then reading the image contents.

| improve this answer | |
  • "redirect to the image" - I don't think you mean redirect? If you did redirect then it doesn't come from within your site, but from the source of the initial HTTP request and the same referer is sent. I would have thought your server-side script should read the appropriate image and serve it to the client in the same request, and this bypasses .htaccess (since it's not HTTP). – MrWhite Dec 4 '12 at 18:42
  • @w3d Valid comment, I'll modify my answer. – Marvin Dec 4 '12 at 19:55
  • Is there a reason someone down-voted my answer? – Marvin Dec 5 '12 at 16:00
  • 1
    Not sure why. When someone down-votes they should (and are encouraged to) leave a comment as to why. Unfortunately I have seen other (apparently correct) answers (including my own) that have been down-voted without any comment. Down-votes can always be undone by the down voter, up-votes are locked in after a period of time or until the answer is edited. – MrWhite Dec 5 '12 at 16:31

This is the code you need

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?your-domain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?google\..+$ [NC]
RewriteRule \.(gif|jpg|jpeg|png)$ https://your-domain.com/hotlink.jpg [R,L]

This code loads hotlink.jpg for sites hotlinking your images, Except for google.??? domains

| improve this answer | |

Wouldn't this work? !^http(s)?://(www\.)?google\.*$/.*$

| improve this answer | |
  • 1
    Maybe add a bit more clarification could be added to this answer as to what exactly you mean. – nathangiesbrecht Aug 12 '15 at 14:49
  • @Joan Manuel Hernandez: yes and no, it works, but with your code any host with domains like "googlefake.com", "google123.es", etc. would be allowed to go through my hotlink protection, making hotlink protection useless. – Marco Demaio Aug 12 '15 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.