By mattyoung on

My log is filled with page not found entries from some site deep linking my image files. The referrer page has <img> link directly to my site. I would like to stop them from doing this. However, when I look at create a access rule to deny this, I see there is no way to deny by referrer. Is there anyway to stop this?

⋅ Categories: Drupal 6.x

Comments

vsr’s picture

vsr commented 
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://www\.mydomain.com/.*$ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ - [F]

Put the above in a .htaccess file in your image directory. This should prevent people from linking directly to your images. Change mydomain to your domain.

Mambo89’s picture

Mambo89 commented

Doesn't work for me. It has different effect on domain with www or without. it doesn't work in FF or in IE(one of them)

I found this site: http://www.onyxbits.de/content/blog/patrick/protecting-your-websites-con...

It should explain how to do this but i am having problems with understanding one paragraf:

>>Once you have installed and enabled these modules, edit the Blog content type. Click the "Manage fields" tab and add a new field of the type "File". The important thing in setting up the new field is to put "cck_upload/node/[nid]" as the value for the file path. You probably also want to enable an unlimited amount of uploads, remove the file type restrictions and hide the new field from public viewing via the "Display settings" tab, so it only shows up, when editing the page.<<

Could someone be so nice and write what i should insert in each line in editing content type...

Many thanks and good bye

EDIT: Ohhh, one post belove is the same link_D_D

px’s picture

px commented

I had a similar problem. Namely, that some social media sites would directly link to software downloads, I provide on my website. Personally, I am not too happy with providing content for them, when in return, I also have to pay for the traffic without actually getting the visitors.

In other words: What I wanted was a way to redirect visitors from a deep linked file to the page, that file belongs to. My approach is to use CCK and Apache rewrite rules to smartly redirect visitors. Basically, CCK makes sure, every upload ends up in a subdirectory of sites/default/files, containing the node id as name, from there a single Apache redirect rule makes sure, visitors get sent to the according page.

mattyoung’s picture

mattyoung commented

Thanks for the very nice write up. This nicely solve the problem with deep linking of valid files. I also have problem with people deep linking to files that no longer exist. I get path like "http://www.mysite.com/cmd/asset/xyz.jpg". I don't have anything like this in my site. What can be done about these?

px’s picture

px commented

Depends on what result you are aiming for. For example, you could create a regular "Sorry, the file you are looking for no longer exists" node. and simply have a rewrite rule, that catches every request to cmd/asset and redirects to this page.

Should look something like this:

RewriteRule ^.*cmd/asset/.*$ http://www.mysite.com/does-not-exist.html [R,NC]

In case, the non existent files are scattered throughout your filesystem, you could grep/awk the requests from your errorlog and use a redirect table, which is basically just a flat text file, containing the rules (see mod_rewrite docs).

If you really want to have fun (and I think, this might be the way, I'd go), then you'd just create a big image (at least 300x200), which states in big neon letters on a pink background, that a deep linked file from http://www.mysite.com was requested, which is no longer available. (Soft)Link that file to each location found in your errorlog. That should mess up the design of the linking pages so badly, that the respective webmasters will gladly fix the problem.

vsr’s picture

vsr commented 
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://www\.mydomain.com/.*$ [NC]
RewriteRule  .*\.(jpg|gif|bmp|png)$ - [F]

If you are using the above in your asset directory, then they will get a forbidden message.

Or you could place this in the asset directory. 

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://www\.mydomain.com/.*$ [NC]
RewriteRule  .*\.(jpg|gif|bmp|png)$ - [G]

By replacing the "F" with a "G" you tell that the content does not exist any more. This may help to keep things out of search engines that index graphics.

If you just want to do this for a few files, then change the last line to this.

RewriteRule  ^(file1|file2|file3)\.(jpg|gif|bmp|png)$ - [G]

Using this last method is a good way to let search engines know that you got rid of some content. Just remember to change the extension to what your files end with.

Hope this helps you.

Mambo89’s picture

Mambo89 commented

Is there any ''no deep linking'' module?

couse no mater what i do in htaccess it makes no diference

aryanto’s picture

aryanto commented

Hello Matej,

I read your private message. I think the most easiest and effective way to prevent hot link to your images is by managing it on the web server, as discuss here. If that does not work, could you please explain more detail why you said "it makes no different"?

Cheers,

Anto

quevo’s picture

quevo commented

Try this instead:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://www\.mydomain\.com(/(.*)?)?$ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ - [F]

Notice the "(/(.*)?)?" at the end of the second RewriteCond. Plus, IE 6 has problems displaying images initially if the trailing "/" is assumed instead of optional.

Of course, the above works reliably only if HTTP_REFERER is not blank (i.e. the first RewriteCond is FALSE). For instance, if I block sending of a referer, as opposed to simply spoofing a referer, the above does not work.