Reasons Not to Hotlink-Protect Your Images

Using .htaccess to block all image requests if the referrer does not originate from your own site is sometimes not a good idea, as I learned today.

  • Images in RSS and Atom feeds do not appear, if parsed by an online aggregator. I’m subscribed to my own RSS feed on NetVibes, just to see if anything is wrong with the feed. Surely enough this paid off, as I discovered that one of my previous posts did not show the designated images.

  • Affiliate and formal linkages to images banners and badges do not work.

  • Hotlink-protected images are not crawled by search engines, as they either lead to an error or a generic image. It is possible to include search engine url’s in the allowed referrer list, but it is hardly possible to include all search engines.

There is really no harm in this actually. If some site is sucking way too much bandwidth, you can block specific referers, using this method.

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} ^http://jackass.com.*$ [NC]
RewriteCond %{HTTP_REFERER} ^http://(.*).jackass.com.*$ [NC]
RewriteRule .*.(gif|jpg|png|jpeg)$ - [F,NC]

Put that in the file with the name .htaccess in your root folder, and all hotlinking from that one domain will be forbidden (images will not show up).

post a comment4 Comments

  1. 1April 5th, 2006Elliot Swan says

    Very interesting, I never thought of that.

    Thanks for the tips.

  2. […] Reasons Not to Hotlink-Protect Your Images–Never thought of that… […]

  3. 3April 5th, 2006EngLee says

    Nice tip. Anyway, how do we detect hotlinking from other sites?

  4. 4April 5th, 2006Oliver Zheng says

    Ha, I actually found a hotlinker from looking at my stats. I visit every referrer, and found that one of them was hotlinking my images.

    I guess normally you’d look at the requests for your files. If one of them shows up quite often, then you’ve got to do something about it (google the filename?). Otherwise, it’s not a problem since it’s not using too much bandwidth anyway.

Post a Comment

Name and email are required (website is optional). Basic HTML is enabled.

Your email address is not revealed to anyone.