I got a problem regarding setting my server settings so that my files can't be accessed from people linking directly to the files, but can when they click a link on my website to open the file.

I tried this:

RewriteCond %{HTTP_REFERER} !^ [NC] 
RewriteCond %{HTTP_REFERER} !^*$ [NC] 
RewriteRule \.(pdf|doc|docx)$ /~child/ [L]

Problem is, when I want to open these files via my website, I get an error, because the link to the file is a direct link, something I wanted to prevent.

So to counter this, I need to let through the referrals from my own website. I tried this:

SetEnvIf Referer "^*$" legit_referal
SetEnvIf Referer "^$" legit_referal

<LocationMatch "\.(pdf|doc|doxc)$" >
   Order Deny,Allow
   Deny from all
   Allow from env=legit_referal

But with no success. I get a server 500 error if I try to access it.

As you can see I use ip-adresses, because I have no domain name, only the ip.

Can someone point me in the right direction?

  • What is the IP address there? It's not loading for me. Does your site have an actual domain name? Jul 28, 2015 at 11:09
  • The ip address is fake. It's just standing there for example.
    – Kuubs
    Jul 28, 2015 at 11:23
  • "server 500 error" usually means a misconfiguration or syntax error, not that your rules are not working. It shouldn't it look like this SetEnvIf Referer "^http://yourdomain.com" legit_referal?
    – Kevin
    Jul 28, 2015 at 11:50
  • Doesnt work as well. It goes wrong with the LocationMatch if I remove that the site doesnt crash.
    – Kuubs
    Jul 28, 2015 at 13:25

1 Answer 1


Problem is, when I want to open these files via my website, I get an error, because the link to the file is a direct link

An ordinary link on your website is not a direct link. If the browser is sending any referer at all then when a user clicks a link on your website then the referer is "your website". If you are not getting a referer header in this instance then "something else" is going on.

However, you probably do need to allow an empty referer for when user's browsers don't send the HTTP referer header (for whatever reason). For example, when users type the URL directly in their browser (this is a direct link), or simply hit the reload button - presumably you do want to allow this? If you don't allow this then it is possible that some legitimate users might have problems accessing your files.

Your first example looks pretty much OK, except that looks a bit weird (this looks like the temporary URL that some shared hosts supply before the domain resolves?). However, the following should work:

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://19\.24\.3\.13
RewriteRule \.(pdf|docx?)$ - [F]

The above will return a 403 Forbidden for PDF, DOC and DOCX URLs when the HTTP referer is not empty AND not the current host. Note that this allows direct requests (when the HTTP Referer is empty). If you wish to prevent direct requests then omit the first RewriteCond directive.

Your second code block results in a 500 Internal Server Error because LocationMatch is not permitted in .htaccess files. You need the Files directive.

UPDATE: I'd previously included %{HTTP_HOST} in the condPattern (2nd argument to the RewriteCond directive) - that was a stupid mistake! Server variables are not evaluated in the CondPattern (a regex) so would have matched the literal string "%{HTTP_HOST}"! Which would never happen, so the condition (a negative match) would always have succeeded and the request would always be blocked!

  • I'll try it out now. Thanks for this informative answer, TIL about referrers :) I'll update soon! EDIT: Ok i tried it, it doesn't work. It lets every request through, nothing seems to be blocked. Couple other things, maybe it has some value for you. I'm running a Joomla installtion and I am trying to get it working with that. About the shared host URL, that is entirely true.
    – Kuubs
    Jul 28, 2015 at 17:00
  • EDIT2: Something happened, I guess the cache cleared, I cannot access any documents at all. I get a Permission Denied.403: FORBIDDEN
    – Kuubs
    Jul 28, 2015 at 17:19
  • The above directives should come immediately after the RewriteEngine On directive.
    – MrWhite
    Jul 28, 2015 at 17:48
  • Hi, I tried your solution, and I still get a permission denied error. Maybe I need to state that the site is a Joomla site, and maybe because of that it's giving these errors.
    – Kuubs
    Aug 11, 2015 at 13:12
  • The fact that it's Joomla should not make any difference - providing these directives are at the top of your .htaccess file then we are operating outside of Joomla. However, the problem could be related to accessing the site via <IP Address>/~child (if that is how you are still accessing the site). What is the (PDF/DOC) URL you are requesting? What is the value of HTTP_HOST?
    – MrWhite
    Aug 11, 2015 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.