Whitelist Referrers/User Agents

You can whitelist based on both agent and referrer. Some sites, like FB, may have odd referrers when they handle images. FB will often have a referrer like this external.ak.fbcdn.net

If you are ever in doubt about user agent or referrers, just keep an eye on your visitor logs when you add an image outside your site. Both should show there.

As for using your images outside your site – this is just what Imaguard is intended to protect you against. The easiest way of avoiding the problem of using images f ex in email signatures, is to add a separate folder outside WP and use the images there. For that folder you can add a htaccess file with its own rules to override the Imaguard rules.

Thanks for the reply. I’ll look through logs.

The image isn’t in a WordPress folder but for some reason, it’s no longer broken. Figures.

Glad it’s working now. In general, if you have WP installed on your root folder, anything in that or any subfolder will be protected unless you add an overriding .htaccess file to the folder in question.

Hi there,

I was just thinking instead of having to whitelist referrers/UAs would it be more expedient to just blacklist instead. Don’t get me wrong the whitelist feature offers the granular control I need at the moment. The only problem I’ve faced is that some of my content is syndicated to various RSS feeds. I’ve also got a feedburner account. This content contains the images that also appear on my posts/pages. From my understanding these hotlinks will be blocked. I can always whitelist these but it gets hard to keep track of all these various locations. I was thinking it might be easier to just blacklist known offenders as they arise.

I might need to look into storing certain sets of images in different directories with a set of htaccess rules targeting these directories.

Kind regards.

We thought about a blacklist instead of a whitelist. But in either case you risk the same problem. Preventing general hotlinking would be very difficult with just a blacklist as you would have to be aware of someone using your images in the first place (which would mean keeping an eye on the logs all the time).

We believe most users still would prefer a whitelist. However we have considered a “reverse whitelist” advanced option so that you check that off and the whitelist becomes a blacklist instead. I was just playing around with a test version earlier today.