Hotlink Protection Do Not Block Google, Bing or Yahoo

[AITpro Admin]

I assume you have added svg to the FilesMatch file types code.  I have very little experience or knowledge about svg files.

<FilesMatch "\.(svg|gif|jpg|jpeg|png|bmp)$">

Not really sure since I don’t have any svg files to test with.  Maybe this link below will be of some help.  You can confirm or eliminate BPS as the cause of an issue/problem by doing the standard troubleshooting steps, which will allow you to isolate the source of the issue/problem.

https://productforums.google.com/forum/#!topic/webmasters/3oHx5nrtkNc

BPS Troubleshooting steps:  http://forum.ait-pro.com/forums/topic/read-me-first-free/#bps-free-general-troubleshooting
BPS Pro Troubleshooting steps:  http://forum.ait-pro.com/forums/topic/read-me-first-pro/#bps-pro-general-troubleshooting

[silas88]

Yes, that is what I have in my code. My trouble shooting test was simply to comment out that FilesMatch section – then the image can be fetched by Google webmaster tools. So I assume the referrer rule must be the problem. I can’t seen anything in the BPS log although my 403 log code is still not working properly, (I haven’t been able to fix that yet but that’s a separate issue). I can see errors in my cpanel error logs when I use webmaster tools to fetch an image (https://www.google.com/webmasters/tools/googlebot-fetch).

[AITpro Admin]

Unfortunately I have zero experience with svg files so I cannot be much help here.  My hunch is that it may have to do with how the XML is being processed and whether it is embedded or stand-alone – that is the complete extent of my knowledge of svg files.  😉  I have also seen references to svg that look something like this:  svg+text / image/svg+xml .  What that means i have no idea.  I guess google around to figure out what could be the problem so that you can come up with a solution – you have to know what the problem is before you can create a solution.  😉

http://googlewebmastercentral.blogspot.in/2010/08/google-now-indexes-svg.html

Another logical guess that maybe you need to whitelist xml too?  Totally guessing.

[silas88]

OK, Thanks for the tips. I’ll search around over the next few days. If I find a solution I’ll post it here.

[Catalin]

Hi there,

I’ve got a related question to this topic. First of all, thank you for the code, I used the instructions and it worked exactly as it should.

I checked to see the results with altlab.com and I saw I can display another image if someone tries to hotlink it. Could you please help me add the extra code to make that happen? I tried it once or twice using their example but it broke the htaccess.  Could I add something like that to the code provided?

[AITpro Admin]

You want to do a rewrite to another image file instead of your actual hotlink protected image files.  http//:i.imgur.com/qX4w7.gif

http://altlab.com/htaccess_tutorial.html

…using the mod_rewrite altlab.com code and adding the Google, Yahoo and Bing domains…

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^(http|https)://(.*mysite\.com.*|.*google.*|.*yahoo.*|.*bing.*) [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(gif|jpg|jpeg|png|bmp)$ http://i.imgur.com/qX4w7.gif [L]

...or...

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^(http|https)://.*(mysite\.com|google|yahoo|bing).* [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(gif|jpg|jpeg|png|bmp)$ http://i.imgur.com/qX4w7.gif [L]

[Catalin]

Thanks for the fast reply! I wanted to use your code – from the first post of this topic (not atlab’s) to do this. Can I do that? How?

[AITpro Admin]

You would need to use mod_rewrite .htaccess code if you want to display another image to someone instead of the hotlink protected images.  The code I posted above does that and also whitelist’s Google, Yahoo and Bing.  The code does exactly what you want.

[Catalin]

Thank you very much, I decided to use your original code and not to display another image instead of the hotlink protected images. Keeping it simple.

[jenni101]

Hi there,

I’m using your code for Hotlink protection in my root .htaccess file for ‘my-domain.com’ with added code to allow images showing in my addon domain, installed in a sub-folder, which looks like this:

SetEnvIfNoCase Referer "^(http|https)://www\.my-domain\.com.*$" whitelist
SetEnvIfNoCase Referer "^(http|https)://www\.my-domain\.co.nz.*$" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*my-domain.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://www\.myaddon-domain\.co.nz.*$" whitelist
SetEnvIfNoCase Referer "^(http|https)://www\.myaddon-domain\.com.*$" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*myaddon-domain.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*google.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*yahoo.*" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*bing.*" whitelist

<FilesMatch "\.(gif|jpg|jpeg|png|bmp)$">
Order Allow,Deny
Allow from env=whitelist
# Add Your Server IP Address
# Note: A Server IP address May be Required for
# everything to work depending on your Host Server
Allow from xyz.ab.cd.efg
</FilesMatch>

This all now works fine (since adding in my addon domain too!) except when I email invoices for purchases from my image library, that’s installed in a sub-folder of my root. So I tested it by commenting out the whole

"<FilesMatch "\.(gif|jpg|jpeg|png|bmp)$">"

section as above, and it all works again… So my question is, why does it block the images from my-domain.com/imagelibrary/image.jpg as I thought this section:

SetEnvIfNoCase Referer "^(http|https)://www\.my-domain\.com.*$" whitelist
SetEnvIfNoCase Referer "^(http|https)://www\.my-domain\.co.nz.*$" whitelist
SetEnvIfNoCase Referer "^(http|https)://.*my-domain.*" whitelist

covered all subfolders and subdomains and addondomains? And as it obviously isn’t whitelisting my imagelibrary, what is the correct way to add this in to the whitelist code? Is it like this?… Thanks for your input with this.

SetEnvIfNoCase Referer "^(http|https)://www\.my-domain\imagelibrary.com.*$" whitelist

[AITpro Admin]

The /imagelibrary/ folder appears to be outside of the WordPress website folder/URL structure / the htaccess heirarchical structure.  ie it is not a parent to child heirarchy/structure and is instead a child to child folder structural relationship.  Probably the simplest thing to do would be to create an .htaccess file in the /imagelibrary/ folder with rules about which referers can link to images or you could just allow any/all sites to link to these images by using a RewriteEngine Off htaccess file.

What is in the /imagelibrary/ folder?  Is it a 3rd party application?  Is it just a plain folder for storing images?  Is there a particular reason you are using this /imagelibrary/ folder instead of the WordPress /uploads/ folder to store images?

[jenni101]

Hi,

yes, it’s a 3rd party software, and is a full stock image library with rights managed calculators etc. It has it’s own .htaccess file in it’s root, and all other things are working fine for it – like customers can still register and login etc despite the brute force security applied in the wp site in the root install – that’s why I thought the hotlink protection would be Ok too, as the whitelist covered all its subfolders too?

I’d ideally want to prevent hotlinking to images on my wp root install site and my image library folder – just not sure how to do it? Hope this explains it better?

Cheers.

[AITpro Admin]

Yeah, but with 3rd Party apps other things/factors are mixed into the equation.  If both sites were WordPress then you would not be having this issue.  In any case, it is ALWAYS better to compartmentalize .htaccess control to each website/folder (mostly for sanity sake/keeping track of what is doing what) by actually controlling each site with its own .htaccess file/code/rules.  So since the image library 3rd party app already has an .htaccess file in its folder then what you want to do is add hotlink protection code in that image library .htaccess file.

Logically you will not have to do anything else with the WordPress site’s .htaccess file/code since what will happen is the /imagelibrary/.htaccess file will control what referers are allowed to link to images.  In the event that the WordPress site’s code is still interfering with that image library htaccess file then you would use a 3rd party rewriterule in the WordPress htaccess file for the /imagelibrary/ folder as shown in the link below.

http://forum.ait-pro.com/forums/topic/custom-applications-outside-of-wordpress-3rd-party-apps/

[jenni101]

Hi AITpro,

Thanks for your reply – so what I understand from you/the above is that if i sort out some hotlink protection code in my imagelibrary sub-folder .htaccess file, then I’d put the following code into my wp root .htaccess file… which I’ll check out with the other software supplier too.

# WP REWRITE LOOP START
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# RewriteRule for Custom Apps outside of WP
RewriteRule ^imagelibrary/ - [L]

OR couldn’t I just whitelist the imagelibrary sub-folder in the wp .htaccess rules in my wp root .htaccess as I mentioned first as I thought the ‘*’ bit after the domain name covered all domain name extensions and sub-folders? If so, how would this be written? many thanks, as always!
ps: how do i add in examples of code properly into your forum, as i can’t find the ‘code’ edit button?? Thanks.

[AITpro Admin]

First you would try just adding the hotlink protection code in the image library .htaccess file.  Next you would add the 3rd party rewriterule in the WordPress .htaccess file ONLY IF NEEDED.

[Author]

Posts