Hotlinking Movie Protection?
 

Anyone know an easy way to prevent movie file hotlinking?

Try to get Zoink's attention. He had a link that showed how....

Check this site out
Anti Hotlinking

or have your movies hosted at www.likewhoa.com They have a scrip that works great!

Add this to your .htaccess (remove the spaces after the < )


SetEnvIfNoCase Referer "^http://site.com/" locally_linked=1
SetEnvIfNoCase Referer "^http://www.site.com/" locally_linked=1
SetEnvIfNoCase Referer "^$" locally_linked=1
< FilesMatch "\.(gif|png|jpe?g|mpg|mpeg|avi|wmv)$">
Order Allow,Deny
Allow from env=locally_linked
< /FilesMatch>

here's the link that zoink previously posted:

http://www.zoink.org/prevent-hotlinking-of-movies.html


- johnny

I hope you're aware that the method you're using is completely useless when attempting to prevent hotlinking of video media files. The media players don't send a referring url to the host. So, even with that .htaccess in place, people will still be able to hotlink your movies. *as far as i know*

Someone correct me if i'm wrong.

www.oxeo.com has antihotlink protection

I have one, contact me if you are interested
http://www.freeones.com/videos/

Umm... but movie players don't give ref urls.

I was thinking about this as a way to do it without using cookies, and keeping things copacetic with TGP's:


1. Create a mysql database with IP & a TIMESTAMP

2. Use mod_rewrite to rewrite all your gallery pages (with .html extentions to please the TGP's) - or anything under your gallery directory to a script in language of your choice (mod_perl, PHP, C.. something fast).... lets call it storeip.cgi

So someone hits galleryXYX123.html and gets redirected to storeip.cgi?galleryXYZ123.html, which stores the persons IP & timestamp and then pulls up the galleryXYZ123.tmpl template.

3. On the gallery page you have links to you actual movie samples. Again, to keep it TGP friendly you don't want to use CGI's.. so you could keep all your movie samples in a folder called MSAMPS & then rewrite all requests to that directory to getmovie.cgi?filename.ext

So a request for movie1.mpg would get rewritten to getmovie.cgi?movie1.mpg which would CHECK THE MYSQL DATABASE for the ip of the person requesting the movie

> if they are in the database, then give them the movie.
> if they are not, then give them the error page.

Again this script should be written with a resource friendly language... mod_perl, mod_php maybe, or better in C.

4. Write a 'flush' script that would flush out the mysql database for anyone entries older than XX mins.


Of course theres always www.antihotlinking.com but I refuse to run any closed source 3rd party apps/scripts on my money-making traffic-producing production boxes. :(

But for $199 or whatever they charge now, it might be the solution for you if your willing to accept the potential risks of running pre-compiled software.

It's a lot easier to implement than my idea, and would be perfect if they gave you the source code to audit. :winkwink:
(As far as I know they wont, but you should dEMAnd it.)

i can make a custom php script like this if someone needs it.

but its for commercial purpose, so its not free.

Has anyone tried this method?

Interesting and worth a try.

The only things are that it will not help you with pages that currently exist without the head tag.

I wonder if TGP's will get pissed about the java.

the cheap simple solutions will only let the users with javasccript or cookies to access the movies. the rest of them will be blocked.

thats not a small % to sacrifice :2 cents:

Sure, but the rest are sent to a sell page formatted for them. It sounds very interesting.

I think that hotlinking is increasingly not the issue though, overwhelming amounts of worthless traffic is more of a problem.

If your URL gets posted on a Chinese BBS this will not do jack squat to help you.

It relies on JA VA SCRIPT & cookies.

I think they underestimate the number of surfers who have opted for 'privacy' (read - no cookies) these days.

Everyone is after anti-popup / popup blocker software these days & those almost always have some cookie blocking function built in.

I don't like to rely on things that users could turn functionality for too easily or accidentally.

DAMN YOU! You're going to make my script idea & publicly charge people for it??? :1orglaugh

You better make it free (and then you can claim all the free fame) or I'll wait until you spam the commerical product on GFY... and then I'll release our version to everyone that wants it for free :winkwink:

But if they have cookies off, and generate a sale, it won't be tracked by your sponsor.. So you're better blocking them, you'll save bandwidth on traffic that won't do any money anyway

Unless you are the sponsor.

Ok I tried this out and it doesn't do quite what I thought it would do. I thought it might block access UNLESS the viewer is actually clicking through your gallery page. A surfer can still cut and paste the direct URL to the movie off of a BBS page.

What you want is to make sure that the surfer is seeing your page, and I guess that means using the cookie method.

I would buy a script that:

1) will only show the movie if the surfer is clicking through my gallery page.

2) can block access to the page itself if referred by a hostile (BBS) page.

3) can block based on IP range.

You could always tag your sample clips with your domain...

Then it wouldn't matter if people hotlinked them right?
(since they would be seeing you.com when they play it)

But what about these Asian BBS's that are probably filled with people who don't have CCs.

Yeah I hear you... or the people that are using their sponsors movies on their own gallery pages.

Yeah I guess some people do need hotlinking protection...

1. htaccess+cookie is a bad idea because, as someone mentioned, you will be surprised how many people have their cookies off, including tgp reviewers.

2. using a perl or php scripts to process each and every request your have is asking for trouble with server load if you have any significant traffic

3. having pages to go through any type of script creates problems with some tgp scripts. they will see this page being modified when they check it.

4. relying only on IP's as a way to authorize the surfers to view movies isn't 100% safe.

I will be happy to address any additional questions about movie antihotlinking. :)

Great, then they would know what site to brute force after they have seen the movie.

The Chinese guys are just not going to pay for membership.