0

I have a LAMP + Wordpress server that I access with the IP address only. I don't plan on getting a domain name for the server.

I want to know if it is possible to prevent hotlinking of resources if my server doesn't have a domain name?

Right now I configured my .htaccess like below, but it doesn't seem to be working.

IndexIgnore */*
php_flag zlib.output_compression Off

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(.+.)?11.22.33.44/ [NC]
RewriteRule \.(zip|gif|jpg|js|css|png)$ - [F]

Edit to add for @JennyD: I checked the access.log and couldn't see a referrer.
My apache2.conf defines a custom log format called 'combined':

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

In my sites-enabled, the 'combined' access log format is used by the directive:

CustomLog ${APACHE_LOG_DIR}/access.log combined

This is what my access.log is showing:

12.34.56.78 - - [04/Jun/2013:11:19:02 +0200] "GET /wordpress/wp-includes/images/admin-bar-sprite.png?d=20111130 HTTP/1.1" 304 187 "http://11.22.33.44/wordpress/wp-includes/css/admin-bar.css?ver=20111209" "Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0"
sogosu
  • 1
  • 3
  • If you look at the access logs when you access the images correctly, what referrer do the logs tell you that the request is coming from? (If you don't have referrer in your logs, look at http://httpd.apache.org/docs/2.2/mod/mod_log_config.html#logformat for info on how to turn it on. – Jenny D Jun 04 '13 at 07:11
  • @JennyD please see the details I added above. – sogosu Jun 04 '13 at 09:42
  • Was the problem solved? –  Nov 20 '13 at 15:18

1 Answers1

0

I don't think that that (.+.)? is supposed to be in there. In a working configuration I would have expected to see something like:

RewriteCond %{HTTP_REFERER} !^http://11.22.33.44/ [NC]
Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
  • Thanks for the reply. I tried your suggestion but hotlinking still works. I can't find any examples of people using the IPv4 address of the server in the .htaccess file, so I'm starting to think that maybe it is not possible with apache2. Anything else you can suggest? – sogosu Jun 04 '13 at 06:14
  • Turn on rewrite logging and see what it says about those requests – Jenny D Jun 04 '13 at 11:54