htaccess codes did not work

Question

This is EXACTLY the same case as: (htaccess) How to prevent a file from DIRECT URL ACCESS?

But, no one of codes provided by answers work for me. I tried 1 by 1, then tried to combine, but still not works. Here is my code:

# prevent direct image url access
# ----------
    RewriteEngine On

    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^http(s)://(www\.)?example\.com [NC]
    RewriteCond %{HTTP_REFERER} !^http(s)://(www\.)?example\.com.*$ [NC]

    # this not works
    RewriteRule \.(png|gif|jpe?g)$ - [F]

    # and this
    RewriteRule \.(png|gif|jpe?g)$ - [F,NC]

    # and this
    RewriteRule \.(png|gif|jpe?g)$ https://example.com/wp-login.php [NC,R,L]

    # even by combining them
# ----------
# /prevent direct image url access

The case simulation: index.php has <img src="test.png" alt=""> and should be normally accessible. The requirement is: http://example.com/test.png shouldn't be accessible.

I use WordPress in wp-engine, and i think WordPres's default rewrite doesn't cause the problem since the code from answers are placed above WordPress rewrite.

UPDATE

I use PHP Version 5.5.9-1ubuntu4.14 on Apache 2 on wp engine

How did you test them? Did you embed the images in a nonallowed site? Or did you just try to access them directly with your browser? — Gerald Schneider, Feb 19 '16 at 07:56
@GeraldSchneider, i updated the question. I test by accessing the current site — Javas Works, Feb 19 '16 at 08:06
take note that after editing htaccess file, you should clear your cache before testing if new rule works or not. — andrew, Feb 19 '16 at 08:15
well, they didnt work both on local or wpengine. -_- no idea why — Javas Works, Feb 19 '16 at 09:38

score 0 · Answer 1 · answered Feb 19 '16 at 08:03

Your rules basically work for me, except for one thing:

The (s) is not doing what you think it does.

RewriteCond %{HTTP_REFERER} !^http(s)://(www\.)?example\.com [NC]

With parentheses you define a group, which doesn't make any sense at this point. If you remove the (s), it works for http.

If you want to use https too you have to write it like this:

RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com [NC]

The ? will make the preceding character (or group, if in parentheses) optional.

urgh, i updated again the question. So, i just remove the (s) as your advice. But still doesnt do both on localhost & wp-engine. — Javas Works, Feb 19 '16 at 08:22

htaccess codes did not work

1 Answers1