Preventing images or other resources from being hot-chained can be achieved through various methods: 1. Use .htaccess to set up anti-theft chains and restrict external access by judging the Referer header; 2. Configure the valid_referers rule in Nginx to prevent illegal requests; 3. Use the Referer whitelist, signature URL and other anti-theft chain functions provided by CDN; 4. Add a watermark or provide thumbnails to the image to reduce the value of theft chain. These methods can be used alone or in combination, effectively reducing bandwidth waste.
Preventing images or other resources from being hotlinked is actually a common requirement, especially when the website traffic or bandwidth is limited. The most direct way is to restrict external sources from accessing your static resources through server configuration.
1. Set up anti-theft chain using .htaccess (for Apache)
If you are using an Apache server, you can set anti-theft link rules through the .htaccess
file. The basic idea is to judge Referer
header of the request. If it is not your own domain name, access will be denied.
Sample code:
RewriteEngine on RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com/ [NC] RewriteRule \.(jpg|jpeg|png|gif|mp4)$ - [F,NC,L]
The meaning of this rule is: If the request source is not your own website, an external request to the image or video file will return a 403 error.
A few points to note:
- Replace
yourdomain.com
into your own actual domain name - File types can be added or decreased as needed
- If you use a CDN or allow some third-party reference resources, remember to whitelist these domain names as well
2. Use Nginx to configure anti-theft link rules
Nginx's approach is also very similar, except that the syntax is different. You can add the following content in the server or location block:
location ~ \.(jpg|jpeg|png|gif|mp4)$ { valid_referers none blocked yourdomain.com www.yourdomain.com; if ($invalid_referer) { return 403; } }
Also replace with your own domain name. After this configuration, requests from non-authorized sources will be blocked.
Tips: If you want to replace it with a prompt image instead of directly returning 403, you can use rewrite
to point to a replacement image, such as:
rewrite ^/images/(.*)$ /images/nohotlink.jpg break;
3. Use the anti-theft link function provided by CDN
Nowadays, many CDN services come with anti-theft chain functions, such as Cloudflare, Alibaba Cloud, Tencent Cloud, etc. They usually support the following ways:
- Referer Whitelist
- Signature URL (with timestamp and key)
- IP black and white list
Using a signed URL is a safer way because even if someone sees a link, it cannot be stolen at will, because the link will expire after a while.
If you are already using CDN, it is recommended to go to the console to see if there are any related settings of "anti-theft link" or "Hotlink protection". Generally, they can be enabled with one click.
4. Add watermark or thumbnail image to the image
This is not a technical anti-theft chain, but it can reduce the value of theft chain. For example, many websites first add a compressed version or watermark before displaying large images, which will not affect the user experience, but will also reduce others' willingness to copy and use them directly.
Some CMS or picture bed systems support dynamic generation of thumbnails, and can also be combined with Nginx or picture processing middleware to perform automatic cropping and watermarking operations.
Basically these are the methods. You can choose one or more combinations based on your server environment. Although the link theft cannot be completely eliminated, it can at least significantly reduce unnecessary traffic consumption.
The above is the detailed content of How to prevent hotlinking of images or other assets?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The main Nginx configuration file is usually located in the conf directory under /etc/nginx/nginx.conf (Ubuntu/Debian, CentOS/RHEL), /usr/local/etc/nginx/nginx.conf (macOSHomebrew) or the source code installation path; you can view the loaded configuration path through nginx-t, ps-ef|grepnginx check the path specified by the startup parameters, or use find/-namenginx.conf and locatenginx.conf to quickly find; the configuration file structure includes global settings, events blocks and http blocks, and common site configurations are common.

When Nginx experiences a "Toomyopenfiles" error, it is usually because the system or process has reached the file descriptor limit. Solutions include: 1. Increase the soft and hard limits of Linux system, set the relevant parameters of nginx or run users in /etc/security/limits.conf; 2. Adjust the worker_connections value of Nginx to adapt to expected traffic and ensure the overloaded configuration; 3. Increase the upper limit of system-level file descriptors fs.file-max, edit /etc/sysctl.conf and apply changes; 4. Optimize log and resource usage, and reduce unnecessary file handle usage, such as using open_l

Enabling Gzip compression can effectively reduce the size of web page files and improve loading speed. 1. The Apache server needs to add configuration in the .htaccess file and ensure that the mod_deflate module is enabled; 2.Nginx needs to edit the site configuration file, set gzipon and define the compression type, minimum length and compression level; 3. After the configuration is completed, you can verify whether it takes effect through online tools or browser developer tools. Pay attention to the server module status and MIME type integrity during operation to ensure normal compression operation.

The stub_status module displays the real-time basic status information of Nginx. Specifically, it includes: 1. The number of currently active connections; 2. The total number of accepted connections, the total number of processing connections, and the total number of requests; 3. The number of connections being read, written, and waiting. To check whether it is enabled, you can check whether the --with-http_stub_status_module parameter exists through the command nginx-V. If not enabled, recompile and add the module. When enabled, you need to add location blocks to the configuration file and set access control. Finally, reload the Nginx service to access the status page through the specified path. It is recommended to use it in combination with monitoring tools, but it is only available for internal network access and cannot replace a comprehensive monitoring solution.

The "Addressalreadyinuse" error means that another program or service in the system has occupied the target port or IP address. Common reasons include: 1. The server is running repeatedly; 2. Other services occupy ports (such as Apache occupying port 80, causing Nginx to fail to start); 3. The port is not released after crash or restart. You can troubleshoot through the command line tool: use sudolsof-i:80 or sudolnetstat-tulpn|grep:80 in Linux/macOS; use netstat-ano|findstr:80 in Windows and check PID. Solutions include: 1. Stop the conflicting process (such as sudos

The main difference between NginxPlus and open source Nginx is its enhanced functionality and official support for enterprise-level applications. 1. It provides real-time monitoring of the dashboard, which can track the number of connections, request rate and server health status; 2. Supports more advanced load balancing methods, such as minimum connection allocation, hash-based consistency algorithm and weighted distribution; 3. Supports session maintenance (sticky sessions) to ensure that user requests are continuously sent to the same backend server; 4. Allow dynamic configuration updates, and adjust upstream server groups without restarting the service; 5. Provides advanced cache and content distribution functions to reduce backend pressure and improve response speed; 6. Automatic configuration updates can be achieved through APIs to adapt to Kubernetes or automatic scaling environments; 7. Includes

A/B testing can be implemented through Nginx's split_clients module, which distributes traffic proportionally to different groups based on user attribute hashing. The specific steps are as follows: 1. Use the split_clients instruction to define the grouping and proportions in the http block, such as 50%A and 50%B; 2. Use variables such as $cookie_jsessionid, $remote_addr or $arg_uid as hash keys to ensure that the same user is continuously allocated to the same group; 3. Use the corresponding backend through if conditions in the server or location block; 4. Record the grouping information through a custom log format to analyze the effect; 5. Track the performance of each group with the monitoring tool

The method to enable HSTS is to configure the Strict-Transport-Security response header in the HTTPS website. The specific operations are: 1.Nginx adds the add_header directive in the server block; 2.Apache adds the header directive in the configuration file or .htaccess; 3.IIS adds customHeaders in web.config; it is necessary to ensure that the site fully supports HTTPS, parameters include max-age (valid period), includeSubDomains (subdomains are effective), preload (preload list), and the prereload is the prerequisite for submitting to the HSTSPreload list.
