I am trying to help a black funeral home stop harassment by a racist site. One request they made was that I prevent direct linking from the racist site to theirs.
The following is the whole .htaccess
When I go to the harassing site (name not listed below as it contains racial slurs) and click one of their links to the funeral home I am never blocked.
What did I do wrong?
ErrorDocument 404 /index.php
RewriteEngine On
Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} racistsitenamehere\.net [NC]
RewriteCond %{HTTP_REFERER} semalt\.com [NC]
RewriteRule .* - [F]
RewriteEngine on
RewriteBase /
RewriteRule ^([^/\.]+)/?$ /page.php?page=$1 [L]
RewriteRule ^([^/\.]+)/([^/\.]+)/?$ /page.php?page=$1&sub=$2 [L]
# block semalt
order allow,deny
deny from 85.58.23.115
deny from 177.21.203.170
allow from all
You're missing an [OR], since the referer can't be BOTH (e.g. AND) of those, you want one or the other to be true:
RewriteCond %{HTTP_REFERER} racistsitenamehere\.net [NC,OR]
RewriteCond %{HTTP_REFERER} semalt\.com [NC]
RewriteRule .* - [F,L]
Also wouldn't hurt to have an L flag in there.
Related
I wanted to keep the redirect rule. but I don't want to have to add site by site so that they can display the image. how can i change this rule so that it can do this trick? thanks in advance. Any help is welcome :)
actual htaccess
<Files ~ "\.(jpg|jpeg|png|gif)$">
Order allow,deny
allow from all
</Files>
RewriteEngine on
RewriteCond %{QUERY_STRING} (?:^|&)fbclid=
RewriteRule ^ / [L,R=permanent]
RewriteCond %{HTTP_REFERER} !^https://mysite,com [NC]
RewriteCond %{HTTP_REFERER} !^https://www.facebook,com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^https://www.facebook,com/ [NC]
RewriteCond %{HTTP_REFERER} !^https://externalsite,com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://externalsite2,com/ [NC]
RewriteCond %{HTTP_REFERER} !^https://mysite,com.*$ [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ https://mysite,com [NC,R,L]
<IfModule mod_php4.c>
php_value engine off
</IfModule>
<IfModule mod_php5.c>
php_value engine off
</IfModule>
<Files ~ "\.((php[0-9]?)|p?html?|pl|sh|java|cpp|c|h|js|rc)$">
Order allow,deny
Deny from all
</Files>
RewriteCond %{HTTP_REFERER} !^https://mysite,com [NC]
RewriteCond %{HTTP_REFERER} !^https://www.facebook,com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^https://www.facebook,com/ [NC]
RewriteCond %{HTTP_REFERER} !^https://externalsite,com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://externalsite2,com/ [NC]
RewriteCond %{HTTP_REFERER} !^https://mysite,com.*$ [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ https://mysite,com [NC,R,L]
I wanted to give full access to other sites to incorporate my content ... redirecting if you access the file directly at example.com/uploads/test.gif
If you simply want to block direct access (in which case the Referer header is empty) and allow all other sites to link to your images (basically the opposite of "hotlink protection") then you can replace the above rule (that redirects such requests to the root) with the following:
RewriteCond %{HTTP_REFERER} ^$
RewriteRule \.(jpg|jpeg|png|gif)$ https://example.com/ [NC,R,L]
This redirects all direct requests to the root / home page.
(You had erroneous commas , in your original directives that would have prevented this from working?!)
HOWEVER, basing this redirect on the HTTP Referer is unreliable - you will get false positives. The Referer is sent by the browser - so the user can control (and suppress) what is sent. The website that is linking to you can also set a referrer-policy that suppresses the HTTP Referer being sent - so all requests from some sites might look like direct requests anyway and end up being blocked. There is no way around this.
I need to prevent direct access to a URL (http://www.example.com/gated-asset). Is there any way to add code to the htaccess file that would redirect all direct traffic to another page (http://www.example.com/form)?
I have tried the following code in my htaccess file, but all pages, including the home page, redirect to www.example.com/form.
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://go.example.com [NC]
RewriteRule .* http://www.example.com/form [R,L]
The entire .htaccess file looks like this (it is a WordPress site):
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://go.example.com [NC]
RewriteRule .* http://www.example.com/form [R,L]
I have also tried the following:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://go.example.com [NC]
RewriteRule ^/$ /form/ [R,L]
RewriteRule ^/$ /gated-asset/ [R,L]
As well as:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://go.example.com [NC]
RewriteRule http://www.example.com/gated-asset http://www.example.com/form/ [R,L]
You need to include http:// in the referrer check if you are matching the beginning (^). Unlike HTTP_HOST, HTTP_REFERER requires it. In addition, the referring URL may include a REQUEST_URI, and so closing the expression at the domain will prevent it from working.
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://go.example.com [NC]
RewriteRule .* http://www.example.com/form [R,L]
If you don't want to include the http://, then you can use the following condition instead:
RewriteCond %{HTTP_REFERER} !go.example.com [NC]
However, I would recommend the first example be used.
Also included here are the R and L flags. R is implied if the rewrite is to an external resource, but it is generally better to include it.
I used the rules that should work, and have worked in the past but every variation I try it continues to serve a the image (clearing cache each time). Other rules like URL rewrites work fine.
I would provide a copy of the error logs but I can't seem to gain access to this through FTP, neither can the person running the server droplet.
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(sub\.)?example.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]
I know this seems like it should all be working, everyone says the codes are correct. Yet for the past few weeks I have been trying find solutions. I'm positive there is something else going on that is not related to the code, I just need help finding it as I'm not too experienced working extensively with htaccess.
Full htaccess:
ErrorDocument 404 /404.php
AuthType Basic
AuthName "Password Protected Area"
AuthUserFile /path/to/.htpasswd
Require valid-user
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?dev.mangazing\.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]
Is this what you're looking for?
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?sub.example.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]
EDIT
Please try to replace your rewrite rule line
Replace:
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]
With:
RewriteRule \.(jpg|jpeg|png|gif)$ http://icons.iconarchive.com/icons/tatice/cristal-intense/256/Ad-Aware-icon.png [NC,R,L]
Your code will look like:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?sub.example.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://icons.iconarchive.com/icons/tatice/cristal-intense/256/Ad-Aware-icon.png [NC,R,L]
Or
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?dev.mangazing\.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://icons.iconarchive.com/icons/tatice/cristal-intense/256/Ad-Aware-icon.png [NC,R,L]
and visit 1 of your image urls, I hope this is working for you.. remember to upload a replacement picture to a server and change replacement URL in the new rewrite rule, this can be done with a transparent 1 pixel image (Not a html/php etc document, it must be an image file!) free hosted at google pages or any other webhosting service you like..
Edit 2
Please try with <IfModule mod_rewrite.c>:
<IfModule mod_rewrite.c>
RewriteEngine on
#Your other anti hotlink commands here...
</IfModule>
More methodes to protect image hotlinking: creating the ultimate .htaccess anti hotlinking strategy
I'm having trouble connecting the dots here. Is there an in between step for changing the url within the .htaccess. This is what I have so far.
moniquetrinidadjewelry.com/necklace/product.php?id=17&product_name=enchanting%2520pearl
and the rewrite
RewriteEngine On
RewriteRule ^$necklace/([a-zA-Z]+)/([0-9]+)/$ product.php?id=$1&product_name=$2
My goal and what I believed to be set as above is a url of moniquetrinidadjewelry.com/necklace/id/product_name
I'm not entirely sure where the issue is coming from. There is no change within the address bar at refresh, reload or a start over of browse.(ie. home necklace> ect.)
Am I missing something important or have I skipped a step not within the htaccess itself?
Edit:
# Use PHP5.3 Single php.ini as default
AddHandler application/x-httpd-php53s .php
# Always use www in the domain
# Replace 'moniquetrinidadjewelry' with your domain name
RewriteEngine on
RewriteCond %{HTTP_HOST} ^([a-z.]+)?moniuetrinidadjewelry.com$ [NC]
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule .? http://www.%1moniquetrinidadjewelry.com%{REQUEST_URI} [R=301,L]
RewriteEngine on
RewriteCond %{QUERY_STRING} ^id=([0-9]+)&product_name=([a-zA-Z]+)$
RewriteRule product.php necklace/%1/%2/
# For security reasons, Option followsymlinks cannot be overridden.
#Options -MultiViews +FollowSymlinks
Options -MultiViews +SymLinksIfOwnerMatch
RewriteEngine on
# Always use www in the domain
# Replace 'moniquetrinidadjewelry' with your domain name
RewriteEngine on
RewriteCond %{HTTP_HOST} ^([a-z.]+)?moniuetrinidadjewelry.com$ [NC]
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule .? http://www.%1moniquetrinidadjewelry.com%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
RewriteRule ^/?(.*/?)index\.(htm|html|php) /$1 [R=301,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php
ErrorDocument 404 /
<Files error_log>
order allow,deny
deny from all
</Files>
# Ultimate htaccess Blacklist 2 from Perishable Press
# Deny domain access to spammers and other scumbags
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ADSARobot|ah- ha|almaden|aktuelles|Anarchie|amzn_assoc|ASPSeek|ASSORT|ATHENS|Atomz|attach|attache|autoema ilspider|BackWeb|Bandit|BatchFTP|bdfetch|big.brother|BlackWidow|bmclient|Boston\ Project|BravoBrian\ SpiderEngine\ MarcoPolo|Bot\ mailto:craftbot#yahoo.com|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clip ping|Collector|Copier|Crescent|Crescent\ Internet\ ToolPak|Custo|cyberalert|DA$|Deweb|diagem|Digger|Digimarc|DIIbot|DISCo|DISCo\ Pump|DISCoFinder|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|ecollector|efp#gmx\.net|Email\ Extractor|EirGrabber|email|EmailCollector|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|FavOrg|fastlwspider|Favorites\ Sweeper|Fetch|FEZhead|FileHound|FlashGet\ WebWasher|FlickBot|fluffy|FrontPage|GalaxyBot|Generic|Getleft|GetRight|GetSmart|GetWeb!|Get WebPage|gigabaz|Girafabot|Go\!Zilla|Go!Zilla|Go-Ahead- Got-It|GornKer|gotit|Grabber|GrabNet|Grafula|Green\ Research|grub- client|Harvest|hhjhj#yahoo|hloader|HMView|HomePageSearch|http\ generic|HTTrack|httpdown|httrack|ia_archiver|IBM_Planetwide|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy*Library|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkagent|Internet\ Ninja|InternetSeer\.com|Iria|Irvine|JBH*agent|JetCar|JOC|JOC\ Web\ Spider|JustView|KWebGet|Lachesis|larbin|LeechFTP|LexiBot|lftp|libwww|likse|Link|Link*Sleuth |LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Mag-Net|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MCspider|Memo|Microsoft.URL|MIDown\ tool|Mirror|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|^Mozilla$|Mozilla.*Indy|Mozilla.*NEWT|Mozilla*MSIECrawler| MS\ FrontPage*|MSFrontPage|MSIECrawler|MSProxy|multithreaddb|nationaldirectory|Navroad|NearSite |NetAnts|NetCarta|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NetZip\ Downloader|NetZippy|NEWT|NICErsPRO|Ninja|NPBot|Octopus|Offline\ Explorer|Offline\ Navigator|OpaL|Openfind|OpenTextSiteCrawler|OrangeBot|PageGrabber|Papa\ Foto|PackRat|pavuk|pcBrowser|PersonaPilot|Ping|PingALink|Pockey|Proxy|psbot|PSurf|puf|Pump| PushSite|QRVA|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT- HTTPClient|Rsync|Scooter|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Seeker|Shai|Siphon|sitecheck|sitecheck.internetseer.com|SiteSnagger|SlySearch|Smar tDownload|snagger|Snake|SpaceBison|Spegla|SpiderBot|sproose|SqWorm|Stripper|Sucker|SuperBot |SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Templeton|TrueRobot|TV33_Mercator|UIowaCrawler|UtilMind|URLSpiderPro|URL_Spider_Pro|Vac uum|vagabondo|vayala|visibilitygap|VoidEYE|vspider|Web\ Downloader|w3mir|Web\ Data\ Extractor|Web\ Image\ Collector|Web\ Sucker|Wweb|WebAuto|WebBandit|web\.by \.mail|Webclipping|webcollage|webcollector|WebCopier|webcraft#bea|webdevil|webdownloader|We bdup|WebEMailExtrac|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WEBMASTERS|WebMiner|WebMirror|webmole|WebReaper|WebSauger|W ebsite|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|W get|Whacker|whizbang|WhosTalking|Widow|WISEbot|WWWOFFLE|x-Tractor|^Xaldon\ WebSpider|WUMPUS|Xenu|XGET|Zeus.*Webster|Zeus [NC]
RewriteRule ^.* - [F,L]
If I understand correctly, you must first capture the query string parts in a RewriteCond and then use that in a RewriteRule
RewriteCond %{QUERY_STRING} ^id=([0-9]+)&product_name=([a-zA-Z]+)$
RewriteRule product.php necklace/%1/%2/ [R,L]
This rule will fire, when there's a URL product.php?id=17&product_name=enchanting%2520pearl and rewrite it to necklace/17/enchanting%2520pearl. The client is redirected and the browser bar should show the new URL.
If you want it the other way round, this one should work
RewriteRule necklace/([0-9]+)/([a-zA-Z]+) product.php?id=$1&product_name=$2
I wish to have request for http://user1.domain.com :
return the output from http://www.domain.com/site-client/site.php?site=user1
AND user still see the URL 'http://user1.domain.com' in the browser
Right now I have the following .htaccess:
RewriteEngine On
RewriteBase /
# Protect the htaccess file
<Files .htaccess>
Order Allow,Deny
Deny from all
</Files>
# Disable directory browsing
Options All -Indexes
RewriteCond %{HTTP_HOST} !^www.domain.com
RewriteCond %{HTTP_HOST} !^admin.domain.com
RewriteCond %{HTTP_HOST} ([^.]+).domain.com [NC]
RewriteRule ^(.*)$ http://www.domain.com/site-client/site.php?site=%1 [L]
The successfully calls the http://www.domain.com/site-client/site.php?site=user1 URL, but it shows it to the user.
How can I avoid this?
You need to get rid of the http://www.domain.com part of yor RewriteRule's target. It tells mod_rewrite that you want a 302 redirect. So your rule should look like this:
RewriteCond %{HTTP_HOST} !^www.domain.com
RewriteCond %{HTTP_HOST} !^admin.domain.com
RewriteCond %{HTTP_HOST} ([^.]+).domain.com [NC]
RewriteCond %{REQUEST_URI} !^/site-client/site.php
RewriteRule ^(.*)$ /site-client/site.php?site=%1 [L]
EDIT: You'll also need a check to keep the rule from looping