Question

I’m trying to use htaccess to deny direct access to all .php files from any domain other than our domain. So i’ve added php to the rule below. But is this the right way? Or is there any other “correct way to do this”

#No Hotlinking
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://mydomain\.com/.*$ [NC]
RewriteRule \.(gif|jpe?g|png|js|css|php)$ - [F]

So:

http://www.mydomain.com/page.php -> OK. Display the page.
http://www.evildomain.com/page.php -> Deny!

Answer 1

This seems fine to me, unless you’d rather use a $_SERVER[‘HTTP_REFERER’] check in your PHP pages directly:

<?php
if ($_SERVER['HTTP_REFERER'] != 'mydomain.com') {
header("Location: goaway.php");
}