How do I figure-out what is blocking some visitors in htaccess when it's NOT the IP range, User-Agent, Referer nor anti-hotlinking?

Forbid empty Referer & all other domains from hotlinking to images, Except for your domain, google, bing or other good domains

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} !^($|(http|https):\/\/.*(mySite1\.com|mySite2\.com|ask\.com|bing\.com|duckduckgo\.com|google\.com|ixquick\.com|msn\.com|startpage\.com|yahoo\.com)) [NC]
RewriteCond %{REQUEST_URI} ^.*\.(bmp|gif|ico|jpg|jpeg|pdf|png|svg|svgz|swf)$ [NC]
RewriteRule ^(.*)$ http://i.imgur.com/qX4w7.gif [R,NC,L]
# RewriteRule ^(.*)$ - [F]
  • I do not understand what you are asking. Can you help us out by explaining the problem more??
    – closetnoc
    Jun 21 '15 at 22:46
  • I don't what is blocking'em. I see nothing obvious. Where do I look next?
    – user49378
    Jun 21 '15 at 23:07
  • where did you get this code?? I do not see anything obvious yet.
    – closetnoc
    Jun 21 '15 at 23:31
  • 1
    Try changing to !^(http|https):\/\/.*(mySite1\.com|mySite2\.com|ask\.com|bing\.com|duckduckgo\.com|google\.com|ixquick\.com|msn\.com|startpage\.com|yahoo\.com) - just as an experiment. The !^($| is like saying if not blank referrer which could be anyone. Of course I could be going cross-eyed.
    – closetnoc
    Jun 21 '15 at 23:36
  • Not everyone is blocked with the code... The hotlink code came more or less from: ait-pro.
    – user49378
    Jun 21 '15 at 23:38

First I would adjust the code slightly so that its more like this:

RewriteCond %{HTTP_REFERER} !^(|(http(|s):\/\/))(mySite1|mySite2|ask|bing|duckduckgo|google|ixquick|msn|startpage|yahoo)\.com$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^$
RewriteCond %{REQUEST_URI} ^.*\.(bmp|gif|ico|jpg|jpeg|pdf|png|svg|svgz|swf)$ [NC]
RewriteRule ^(.*)$ http://i.imgur.com/qX4w7.gif [R=301,NC,L]

How visitors are being blocked

The first line in the code means search for a pattern that may start with http://, https:// or no prefix, then add to the search query any of: mySite1, mySite2, ask, bing, duckduckgo, google, ixquick, msn, startpage, yahoo, then add .com. If a match is found, then go to the image extension check. Otherwise check for an empty referrer string and if it matches, then continue to the image extension check.

If the URL (minus domain) contains any of: .bmp, .gif, .ico, .jpg, .jpeg, .pdf, .png, .svg, .svgz or swf, and the referrer check is true then all requests that match are redirected to http://i.imgur.com/qX4w7.gif.

Why redirecting to image on another server may be bad

Also, with your method, when users come from an unauthorized URL such as facebook, they will see the image, but the image is on another server unless you're running imgur.com. The downfall to this is if that server goes down and someone without authorization wants an image, they will either end up with a 404 page from imgur.com or a 500 internal server error page, or the browser may hang (depending on the bad health of imgur.com).

Another reason its bad to link to a remote image to handle error is because the image on a remote server could change at any time, especially if you have no authorization to manage the image file. You wouldn't want the image to show the hotlink message one day as intended and the next day, it suddenly switches over to a picture of a country flag, would you?

What you should do instead is make a much simpler image that takes up almost no space (like less than 1 KB). Try a static GIF that's no more than 200px wide by 200px high and that contains no more than a few colors. Then upload that image to your server and use it instead of one from imgur.com.

That way, if everything else crashes around you then people without authorized access to the images will see the simpler image (hot-linking message) when they want the protected images.

  • Did you find what specifically was wrong with the code??
    – closetnoc
    Jun 22 '15 at 2:34
  • The new slimmer code zaps all my graphics 8( For some odd reason my no hotlink gif has never worked? Could this be the bug code from my shared webhost? RewriteCond %{HTTP_HOST} ^mySite1\.com$ [OR] RewriteCond %{HTTP_HOST} ^www\.mySite2\.com$ RewriteRule ^/?$ "http\:\/\/www\.mySite1\.com\/" [R=301,L]
    – user49378
    Jun 22 '15 at 3:20
  • The !^($|( part of the original code is a problem because ($|whatever) means trying to match either something screwy or whatever so I removed the dollar sign to remove error, and for HTTP_HOST, remove the www\. and add a space and [NC] after the com$so that the actual domain can be matched regardless of casing. and your rewriterule in your comment redirects just the domain or a / in the URL to the new one. Jun 22 '15 at 4:30

Here's other code that is similar to yours that makes it easy to understand what is blocking:

RewriteCond %{HTTP_REFERER} !^http:\/\/mySite1.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/mySite2.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/ask.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/bing.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/duckduckgo.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/google.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/ixquick.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/msn.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/startpage.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http:\/\/yahoo.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/mySite1.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/mySite2.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/ask.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/bing.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/duckduckgo.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/google.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/ixquick.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/msn.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/startpage.com$ [NC]
RewriteCond %{HTTP_REFERER} !^https:\/\/yahoo.com$ [NC]
RewriteCond %{REQUEST_URI} ^(.*)\.(bmp|gif|ico|jpg|jpeg|pdf|png|svg|svgz|swf)$ [NC]
RewriteRule ^(.*)$ http://i.imgur.com/qX4w7.gif [R=301,NC,L]

RewriteCond %{HTTP_REFERER} ^$
RewriteCond %{REQUEST_URI} ^(.*)\.(bmp|gif|ico|jpg|jpeg|pdf|png|svg|svgz|swf)$ [NC]
RewriteRule ^(.*)$ http://i.imgur.com/qX4w7.gif [R=301,NC,L]

I know its long, but the first several lines are simple. Each line works with one URL and if the referrer isn't the url listed, then the list continues on down to try to match the image extension and if it matches then redirect to the no-hotlink image from imgur.com

The second set of lines are easier to understand. It basically looks for an empty referral string and does the same image extension verification as usual and redirects if theres a match.

You can add and remove sites as you please.

  • What I don't understand is the internal no-Hotlinking.gif will not work, but a external one will? Is there a way to whitelist that one image so it will? I'm guessing SetEnvIfNoCase Referer might work better than RewriteCond %{HTTP_REFERER}?
    – user49378
    Jun 22 '15 at 21:29
  • Just before RewriteRule, you can add RewriteCond %{REQUEST_URI} !^/path/to/no-Hotlinking.gif$ [NC]. If you take it as-is, then http://example.com/path/to/no-Hotlinking.gif will be accessible in its normal form. Replace /path/to with the applicable folder the image is in. Jun 22 '15 at 23:15
  • Thanks This works great! # Hotlink Protection with no-hotlinking.gif Whitelist <IfModule mod_rewrite.c> RewriteCond %{HTTP_REFERER} !^($|(http|https):\/\/.*(mySite1\.com|mySite2\.com|google\.com|bla\.com|bla\.com)) [NC] RewriteCond %{REQUEST_URI} ^.*\.(bmp|gif|ico|jpg|jpeg|pdf|png|svg|svgz|swf)$ [NC] RewriteCond %{REQUEST_URI} !^/images/no-hotlinking.gif$ [NC] RewriteRule ^(.*)$ mySite1.com/images/no-hotlinking.gif [NC,R,L] </IfModule> My code does not look nice on stackexchange... even w/ How2.
    – user49378
    Jun 23 '15 at 4:43
  • By changed the code to SetEnvIfNoCase; would it also allow a blocked IP to view my images if they have no Referer? It looks some blocked IP's can now view my site or images. I hate PIC Thieves! <code>SetEnvIfNoCase Request_URI "^/images/no-hotlinking.gif$" whitelist ErrorDocument 403 example.com/images/no-hotlinking.gif ErrorDocument 403 /images/no-hotlinking.gif</code>
    – user49378
    Jun 26 '15 at 2:52
  • I don't really use SetEnv so much because I handle that more in PHP, but from what I see, you have three lines of code, but the first line suggests to me that if someone requests /images/no-hotlinking.gif from your server, then the whitelist variable is set. ErrorDocument means define what is loaded when someone tries to access anything on the same server that results in a 403 error. Jun 27 '15 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy