Search code examples
ipsubdomainblocking

How do I block a website's IP address using images from my sub domain (images.domainname.com)?

I have a .htaccess file in the images.domainname.com subdomain. I have tried

order allow,deny deny from "id address i want to block" allow from all

but this didn't work...

Solution

  • Indeed, if the website is simply embedding the images with HTML, the IP address of the website won't show as the requester. Your server will get the IP address of the visitor on the copying website.

    However, .htaccess rules can be used to check that the HTTP referrer doesn't come from badwebsite.com. A word of warning here – not all browsers send a HTTP referrer. Therefore, it is important to remember that the referrer might be blank.

    The following will deny access to jpg, jpeg, png and gif files if the referrer is not empty and not from yourdomain.com. Replace yourdomain.com with your actual domain in the following code.

     RewriteEngine on
 RewriteCond %{HTTP_REFERER} !^$
 RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
 RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

    One disadvantage of this: if people find an image from Google and click through, they will be blocked as well if their browser sends a referrer. This might not be a big deal but would require some testing on your part to determine whether or not you're happy with the behavior.

    Alternatively, you could:

    1. Contact the site owner about the issue. Give him a handful of days to respond.
    2. Rename your images. This entails updating the references to the images in your HTML etc., so this may not be possible depending on the size of your site.

    As a less serious remark: if the owner fails to reply after a sensible time, don't forget that you basically control a part of his website. ;)

    You could use images with huge dimensions instead and possibly break the design or upload an image with a polite request to remove the embedded images. This is not recommendable in any professional context, of course, and I would really, really urge that you keep things clean; you don't want to be held responsible for displaying inappropriate content to unsuspecting visitors, ethically as well as legally.