hotlinking prevention via htaccess doesn't work

Question

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mysite.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mysecondsite.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://imgur.com/gallery/tASrcBw [NC,R,L]

I'm using wordpress and pasted above code into my htaccess but still I'm seeing other sites using my hosted images. Why?

Answer 1

Your current rewrite configuration allows anyone to directly access your image by typing its URL in their address bar and the HTTP_REFERER header will not be set, making your first condition fail.

# Check other conditions and rewrite rule only if %{HTTP_REFERER} is NOT empty
RewriteCond %{HTTP_REFERER} !^$

Your conditions are implicitly AND unless you use the [OR] flag. When the first condition fails, the other conditions will not be tested and the redirection to your imgurl message never happens.

Fix:

RewriteEngine on

# If this condition is true, skip the other conditions and redirect
RewriteCond %{HTTP_REFERER} ^$ [OR]

# Redirect to imgurl only if image requests are NOT from own site references
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mysite.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mysecondsite.com [NC]

# Do the redirection for images
RewriteRule \.(jpg|jpeg|png|gif)$ http://i.imgur.com/tASrcBw.png [NC,R=302,L]