Using .htaccess to restrict access to images

[Burgin]

I found where

deny from all
in .htaccess blocks all access to that directory and prevents any images within that directory being displayed on my website. So I tried...

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.com/angryman.gif [R,L]

This allows my website to display any images but they can still be accessed by the public.

Any ideas what I need to do to be able to use the images myself but not be access by anyone else?

[Beverleyh]

Not sure exactly what you're trying to achieve -

Is it just the default directory listing that you want to suppress? ( eg. When you view a directory in a web browser and it lists the files?)

Are you wanting to prevent hot linking? (So people can't embed images from your website on their own pages)

Please can you clarify what you need to happen/not happen and in what circumstances.

[traq]

...Any ideas what I need to do to be able to use the images myself but not be access by anyone else?

What do you mean by that? Since you reject the solution that allows the images to be displayed on your site, but not on other domains, I assume you're looking for more than "hotlink" protection. Do you want to deny everyone (except you, personally) access to the images?

[Burgin]

OK... I've designed a website for a photographer and the photos are displayed as a HTML background images. All are stored in a directory called img and I want to protect them from being copied and/or hot linked. I have protected them from the RightClick > Save Background As by using an overlay div but they can be copied from their URL and via a Google Image search.

[Beverleyh]

Here's how to stop direct URL access to images with htaccess : http://stackoverflow.com/questions/10236717/htaccess-how-to-prevent-a-file-from-direct-url-access

As far as blocking images from the Google images search, you can do it with a robots.txt file - here's Google's own recommendation on that : http://support.google.com/webmasters/bin/answer.py?hl=en&answer=35308

There will still be workarounds though - eg. Print screen - so if somebody really wanted those images, they'd probably find a way. As always, the safest way to protect anything is to not put it online.

[Burgin]

@Bev... Thanks for your reply, much appreciated.

What I'm trying to copy is what some website offering desktop posters do. Their images get listed on Bing but when you click on the VIEW FULL SIZE link a "block" message or image is displayed.

[bernie1227]

like this?:
http://www.markinns.com/articles/full/hotlinking_bandwidth_theft

[Burgin]

Thanks Bernie I've added the code from the above article and it's stopped hotlinking but anyone who views the source in chrome can see the image URL and click to access it. How can that be prevented?

[Beverleyh]

Sadly, that's the nature of the browser and I dont think it's something you can disable via a served web page.

A workaround could be to replace any <img src="/path/to/img.jpg" /> tags with a div tag, and then set the images as backgrounds in the CSS. Chrome will hyperlink the path to the actual CSS file when the source of the web page is viewed, allowing the user easy access to that, but once the stylesheet is open, the image paths inside aren't hyperlinked. The img paths are still visible but then a copy and paste would be needed in the address bar, which should then trigger your .htaccess protect.

[traq]

There's only so much you can do. This thread (http://www.dynamicdrive.com/forums/showthread.php?48916-Why-you-cannot-protect-your-source-code-and-files) might interest you.