# Hotlink Protection Problem

**URL:** <https://www.ruby-forum.com/t/hotlink-protection-problem/169822>\
**Category:** NGINX\
**Created:** [June 9, 2009, 9:59am UTC](https://www.ruby-forum.com/t/hotlink-protection-problem/169822 "2009-06-09T09:59:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jerleung](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@jerleung](https://www.ruby-forum.com/u/jerleung)\
**Post date:** [June 9, 2009, 9:59am UTC](https://www.ruby-forum.com/t/hotlink-protection-problem/169822/1 "2009-06-09T09:59:31Z")

</div>

I was trying to prevent hotlinking for [http://mydomain.com/photos/](http://mydomain.com/photos/)

then I use the following in nginx.conf

```
            location ~ /photos/ {
                    valid_referers none blocked server_names;
                    if ($invalid_referer) {
                    return 403;
              }
            }

```

I found that it will block hotlinking from other sites and return 403.  
However, it will return 404 when the referer is [mydomain.com](http://mydomain.com)

After testing for quite some time, I found that the following will work

```
            location ~ /upload/ {
                    root 

```

/home/domainuser/domains/mydomin.com/public\_html;  
valid\_referers none blocked server\_names;  
if ($invalid\_referer) {  
return 403; }  
}

It only works when I add root to it. Yet, most tutorial does not state  
that. Is it a buy on nginx 0.7.59 or I have set something wrong in the  
nginx.conf so that I have to add the root?

Posted at Nginx Forum:

> **[Hotlink Protection Problem](https://forum.nginx.org/read.php?2,2730,2730#msg-2730)**
>
> I was trying to prevent hotlinking for http://mydomain.com/photos/ then I use the following in nginx.conf location ~ /photos/ { valid\_referers none blocked server\_names; if ($invalid\_referer)

---

<div class="post-metadata">

**Author:** ![jerleung](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@jerleung](https://www.ruby-forum.com/u/jerleung)\
**Post date:** [June 9, 2009, 10:30am UTC](https://www.ruby-forum.com/t/hotlink-protection-problem/169822/2 "2009-06-09T10:30:00Z")

</div>

Hello!

On Tue, Jun 09, 2009 at 03:49:39AM -0400, jerleung wrote:

> I found that it will block hotlinking from other sites and return 403. However, it will return 404 when the referer is [mydomain.com](http://mydomain.com)
> 
> After testing for quite some time, I found that the following will work
> 
> ```
> location ~ /upload/ {
> 
> ```

Any reason to use “~”? It does regexp matching instead of prefix  
one and shouldn’t be used unless required.

> ```
> root /home/domainuser/domains/mydomin.com/public_html;
> valid_referers none blocked server_names;
> if ($invalid_referer) {
> return 403; }
> }
> 
> ```
> 
> It only works when I add root to it. Yet, most tutorial does not state that. Is it a buy on nginx 0.7.59 or I have set something wrong in the nginx.conf so that I have to add the root?

Normally root is inherited from upper configuration levels. E.g.  
you may specify root once for server{}:

```
server {
    server_name mydomain.com;
    root /home/domainuser/domains/mydomin.com/public_html;

    location / {
        ...
    }

    location /upload/ {
        valid_referers none blocked server_names;
        if ($invalid_referer) {
            return 403;
        }
    }
}

```

Maxim D.

---

<div class="post-metadata">

**Author:** ![jerleung](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df788c/32.png) [@jerleung](https://www.ruby-forum.com/u/jerleung)\
**Post date:** [June 9, 2009, 2:41pm UTC](https://www.ruby-forum.com/t/hotlink-protection-problem/169822/3 "2009-06-09T14:41:37Z")

</div>

Thanks Maxim. I have made one mistake. I read some tutorial on the web  
and I have put root under location /

Really thanks for your reply.

Posted at Nginx Forum:

> **[Re: Hotlink Protection Problem](https://forum.nginx.org/read.php?2,2730,2740#msg-2740)**
>
> I was trying to prevent hotlinking for http://mydomain.com/photos/ then I use the following in nginx.conf location ~ /photos/ { valid\_referers none blocked server\_names; if ($invalid\_referer)