HOWTO: Prevent Hot-linking of Your Images Using Apache's mod_rewrite Engine

Hot-linking (a.k.a., inline linking) of images and other resources is a common problem for system and network administrators across the web.  In a nutshell, hot-linking involves folks using your site/blog as the hosting mechanism for images and other resources on their sites or forums.  Wikipedia has a nice write up on hot-linking.  For example, when a user posts a message on a forum that includes an <img> tag sourcing an image hosted on kolich.com:

<img src="http://mark.koli.ch/american-flag.png" />

This is irritating to system and network administrators because it wastes bandwidth and unnecessarily consumes server resources.  Unless you're running a dedicated static content server, why would you want to use your web-server and network bandwidth to host images for forums or other blogs?  In most cases, you don't.

Luckily, Apache's mod_rewrite module makes it easy to stop hot-linking by blocking requests for images and other content that don't originate from your domain.  Here's my Apache configuration (in httpd.conf) that stops the hot-linking of my images.  Note, you can also put this in an .htaccess file assuming your hosting provider gives you permission to do so:

## Prevents hot-linking of my images on other sites.
## Will send back a 49x49 transparent pixel in place
## of hot linked images sourced from other sites.
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?kolich\.(com|mobi)/ [NC]
RewriteCond %{HTTP_REFERER} !.*twitter\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpe?g|gif|bmp|png)$ /pixel.gif [L]

Using RewriteCond, I can check the HTTP referrer header to ensure that the request for an image originated from a user visiting my blog (under *.kolich.[com,mobi]).  I also allow requests originating from *.twitter.com given that I often post images and other stuff to my Twitter feed.  If the request for an image did not originate from *.kolich.[com,mobi] (e.g, on a forum or another blog) I simply send back a 1x1 transparent pixel (49-bytes) instead of the image itself.

Here's a request in my log files showing that someone tried to hot-link to my "case of the monday's" image in this forum thread.  Note that I'm sending back the 1x1 transparent pixel (49-bytes) instead of the actual JPG image the user tried to source:

173.34.220.243 - - [11/Jul/2009:11:40:18 -0700]
   "GET /2009/01/05/case-of-the-mondays.jpg HTTP/1.1" 200 49
   "http://forums.vwvortex.com/zerothread?id=2130343&page=63"
   "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB5)"

Enjoy.