I want to restrict downloads so that users are only able to access the /uploads folder if they click a link from my domain - i.e. they couldn't access any file in `/uploads' by pasting it into the address bar, or following a link from another site, e.g. Google.

This question has an accepted answer that describes what I want to do using wp_rewrite, but not how to do it. Can someone point me in the right direction?

  • 2
    read the comments on that answer- you can easily spoof referrer in your browser so it looks like the request originated from a link on your site. – Milo Apr 8 '16 at 15:50

The link you provided deals with restricted access based on user permissions. But I gather from your question that you want to block hotlinking as a whole.

If you don't already have one, you should create a .htaccess file in your root Wordpress directory (same location as wp-config.php). Add the following to it:

# WP writes the following block
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress
# WP-written-block ends here

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourwebdomain\.com(/)?.*$ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ [F,NC]

The Block Hotlinking part can be modified to block files of other mime types.

You could also Google for "wordpress htaccess hotlinking"

Update - Google indexing images

You can add google.com to the accepted referrers. Your images will show up on Google search but any site other than yours (and google.com) won't be able to directly link to them.

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(.+\.)?google\.com [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?yourwebdomain\.com(/)?.*$ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ [F,NC]
  • hot link protection is so easy to overcome it is very funny how much effort people put into it. – Mark Kaplun Apr 9 '16 at 11:28
  • @MarkKaplun It's commonly understood that if you're developing a high security website you would not use an off the shelf CMS and you would know how to secure all your files with firewalls and sessions. Most people here aren't attempting to fend off Certified Ethical Hackers. They are only trying to prevent band-width theft and make their Google Analytic reports make sense. – Phaze Phusion Apr 9 '16 at 11:50
  • sorry for you, you should realy stop reading people tht pretend they understand anything in security while they don't – Mark Kaplun Apr 9 '16 at 11:55
  • @MarkKaplun - I'm not interested in making it super secure. The suggestions here work fine for me, and there's no need to be so aggressive to Phaze. – SinisterBeard Apr 11 '16 at 8:15
  • @BFWebAdmin, so you are happy with goolge not indexing you images and maybe penalyzing your site for resources that do not load, it is truly your problem, but "off the self CMSes not being secured I am looking for actually more aggressive way to say "what an idiotic idea" but can not find. – Mark Kaplun Apr 11 '16 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.