I want to restrict downloads so that users are only able to access the /uploads folder if they click a link from my domain - i.e. they couldn't access any file in `/uploads' by pasting it into the address bar, or following a link from another site, e.g. Google.

This question has an accepted answer that describes what I want to do using wp_rewrite, but not how to do it. Can someone point me in the right direction?

  • 2
    read the comments on that answer- you can easily spoof referrer in your browser so it looks like the request originated from a link on your site.
    – Milo
    Apr 8, 2016 at 15:50

1 Answer 1


The link you provided deals with restricted access based on user permissions. But I gather from your question that you want to block hotlinking as a whole.

If you don't already have one, you should create a .htaccess file in your root Wordpress directory (same location as wp-config.php). Add the following to it:

# WP writes the following block
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress
# WP-written-block ends here

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourwebdomain\.com(/)?.*$ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ [F,NC]

The Block Hotlinking part can be modified to block files of other mime types.

You could also Google for "wordpress htaccess hotlinking"

Update - Google indexing images

You can add google.com to the accepted referrers. Your images will show up on Google search but any site other than yours (and google.com) won't be able to directly link to them.

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(.+\.)?google\.com [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourwebdomain\.com(/)?.*$ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ [F,NC]
  • hot link protection is so easy to overcome it is very funny how much effort people put into it. Apr 9, 2016 at 11:28
  • @MarkKaplun It's commonly understood that if you're developing a high security website you would not use an off the shelf CMS and you would know how to secure all your files with firewalls and sessions. Most people here aren't attempting to fend off Certified Ethical Hackers. They are only trying to prevent band-width theft and make their Google Analytic reports make sense. Apr 9, 2016 at 11:50
  • sorry for you, you should realy stop reading people tht pretend they understand anything in security while they don't Apr 9, 2016 at 11:55
  • @MarkKaplun - I'm not interested in making it super secure. The suggestions here work fine for me, and there's no need to be so aggressive to Phaze. Apr 11, 2016 at 8:15
  • @BFWebAdmin, so you are happy with goolge not indexing you images and maybe penalyzing your site for resources that do not load, it is truly your problem, but "off the self CMSes not being secured I am looking for actually more aggressive way to say "what an idiotic idea" but can not find. Apr 11, 2016 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.