Anti-leech control using .htaccess
Posted: Sun Nov 29, 2009 3:38 am
Using the .htaccess method of anti-leech control is Pretty Wortthless and can often cause many problems for your website.
You may see htaccess code such as this claiming to provide anti-leech control for, in this case, gif jpg and png files. What this code does is stop any request that was not referred from the yoursite.com domain name.
The problem is this anti-leech method relies on the http-referer code. The referrer is sent by the client (browser). That is the problem. Referrer is blocked by many firewalls and is not sent by many configurations. So you may think you have stopped leeching problems, when what you have really done is block many people from seeing your website.
You can kid yourself into thinking it works, and run a test that shows it does. But it only blocks people who are sending you an invalid referrer code. Maybe better than nothing, but not much better. All those people who get blockled will just go somewhere else assuming your website has too many errors since your images will not show.
To solve this problem, you see many examples like this:
The above example adds a line to let through any request which does not have a referrer code. Yes, this does allow all those configurations which block referrer code to see your images. However, if you open the door to allow anyone in with no referrer then you are watering down the protection to near worthless.
Then, to make matters worse, the referrer code can be easily faked anyway.
If you want to protect your images, consider using a watermark and denying access to the original unwatermarked copy. You can find a watermark script and associated access control instructions this Tips & Scripts page.
If you are having trouble with a site leeching taking too much bandwidth, block that site. You can find instructions for blocking traffic to your website on this Tips & Scripts page.
You may see htaccess code such as this claiming to provide anti-leech control for, in this case, gif jpg and png files. What this code does is stop any request that was not referred from the yoursite.com domain name.
Code: Select all
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} !error.gif$
RewriteCond %{HTTP_REFERER} !yourdomain.com
RewriteRule \.(gif|jpg|png)$ /error.gif [L]
You can kid yourself into thinking it works, and run a test that shows it does. But it only blocks people who are sending you an invalid referrer code. Maybe better than nothing, but not much better. All those people who get blockled will just go somewhere else assuming your website has too many errors since your images will not show.
To solve this problem, you see many examples like this:
Code: Select all
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} !error.gif$
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !yourdomain.com
RewriteRule \.(gif|jpg|png)$ /error.gif [L]
Then, to make matters worse, the referrer code can be easily faked anyway.
If you want to protect your images, consider using a watermark and denying access to the original unwatermarked copy. You can find a watermark script and associated access control instructions this Tips & Scripts page.
If you are having trouble with a site leeching taking too much bandwidth, block that site. You can find instructions for blocking traffic to your website on this Tips & Scripts page.