I've been playing with my htaccess file to better secure Joomla but I'm stuck at this example (reference):

## Referrer filtering for common media files. Replace with your own domain name.
## This blocks most common fingerprinting attacks ;)
## Note: Change www\.example\.com with your own domain name, substituting the
## dots with \.  i.e. use www\.example\.com for www.example.com
RewriteRule ^images/stories/([^/]+/)*([^/.]+\.)+(jp(e?g|2)?|png|gif|bmp|css|js|swf|ico)$ - [L]
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com [NC]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule \.(jp(e?g|2)?|png|gif|bmp|css|js|swf|ico)$ - [F]

I've added this example as a test and it messes up my site (obviously changing example.com to my site). I guess I'm not really sure what this is actually doing. images/stories/ doesn't exist on my server so what is this trying do?

I'm using Joomla 2.5

1 Answer 1


First of all, I'm by no means an expert in .htaccess usage.

The code you've posted will not allow anyone to hotlink your content, the only exception being defined in the following line:

RewriteRule ^images/stories/([^/]+/)*([^/.]+\.)+(jp(e?g|2)?|png|gif|bmp|css|js|swf|ico)$ - [L]

The line RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com [NC] defines the domain that is allowed to access any content, thus event a tiny error will stop Joomla from loading CSS, JS, images etc. from other directories. You should double-check this.

You can also replace line #5 with this:

RewriteRule ^((components|modules|templates|images|plugins|media)/.*\.(jpe|jpg|jpeg|jp2|jpe2|png|gif|bmp|css|js|swf|html|mpg|mp3|mpeg|mp4|avi|wav|ogg|ogv|xls|xlsx|doc|docx|ppt|pptx|zip|rar|pdf|xps|txt|7z|svg|odt|ods|odp|flv|mov|ico|htm))$ $1 [L]

I found some additional info here:

The idea is that if you're going to disable HTTP referer validation, be consistent and do it site-wide to avoid hard-to-trace problems. Besides, this feature only offers limited protection against fingerprinting attacks (i.e. attempts of hackers to fly under the radar in order to figure out which Joomla! release you're using).

Basically, the code snippet you're using might cause more problems than it's worth.

  • Thanks for finding that reference. I still don't know the issue with it but I think for now there is no point in adding it.
    – Tom
    Aug 12, 2014 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.