Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
Stop hot-linking and bandwidth theft!
Bandwidth can be expensive. So it can be annoying if other websites steal your bandwidth from you. A common problem is when people use 'hot-linking' or 'deep-linking' to place images from your site on to their own pages. Every time someone views their website, you will pick up the bandwidth tab, and users of your website may be impacted because of the reduced bandwidth.
So how can this be stopped?
When a web browser requests a page or an image from your site, the request includes a 'Referer' header (The misspelling is required in the specs!). This referrer gives the URL of the page that linked to the file. So, if you go to https://splash.riverbed.com/, your browser will load the HTML for the page, and then load all the images. Each time it asks the web server for an image, it will report that the referrer was https://splash.riverbed.com/.
We can use this referrer header to check that the image is being loaded for your own site, and not for someone else's. If another website embedded a link to one of these images, the Referer: header would contain the URL of their site instead. This site has a more in-depth discussion of bandwidth-stealing; the Stingray approach is an alternative to the Apache solution it presents.
Solving the problem with RuleBuilder
RuleBuilder is a simple, GUI front-end to TrafficScript that lets you create straightforward 'if condition then action'-style policies. Use the Stingray Admin Server to create a new RuleBuilder rule as follows:
You should then associate that with your virtual server, configuring it to run as a Request Rule:
We can make some simple improvements to this rule:
We can provide a simple list of file extensions to check against, rather than using a regular expression. This is easier to manage, though not necessarily faster
We can check that the referer matches the host header for the site. That is a simple approach that avoids embedding the domain (e.g. riverbed.com) in the rule, thus making it less likely to surprise you when you apply the rule to a different website
First convert the rule to TrafficScript. That will reveal the implementation of the rule, and you can edit the TrafficScript version to implement the additional features you require: