Defeating Source Code Page Copying Thieves
When thieves copy the source code of your web pages and republish them on their own domain, they may be defeated.
Set things up by ensuring each web page to be protected imports a JavaScript file. The src= URL needs to be the absolute http://... URL to a JavaScript file on your server.
If your pages don't already do so, create a file named myjsfile.js and upload it to your server. The file can contain this single line:
document.write("");
To import the file, use this:
<script type="text/javascript" src="https://example.com/myjsfile.js"></script>
Replace http://example.com/myjsfile.js with the absolute http://... URL to myjsfile.js on your server.
Okay, your pages are set up.
Implementing the Protection
If the entire web page source code is copied for use somewhere else, the JavaScript to import an external file is also copied.
The .htaccess file is used to take control should the web page source code be published on another domain.
Control is obtained by sending alternate JavaScript to stolen web pages. That JavaScript can be anything you want it to be, from a benign notice to replacing the content of the entire page.
I would suggest something more benign than draconian, like a notice popup or a redirect to your own website. Some people just don't think and have no active bad intent when republishing the source code of web pages.
To implement the protection, first, create a .js file of whatever alternate JavaScript you want to deliver to the stolen web page.
Then, copy the following code, make changes, and put it into your .htaccess file. I strongly suggest trying the code in an .htaccess file in a subdirectory before putting it into the document root directory. It's easy to mess up the .htaccess file with a simple little typographical error.
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://example\.com(/)? [NC]
RewriteCond %{HTTP_REFERER} !^https?://www\.example\.com(/)? [NC]
RewriteRule ^.+\.js$ http://www.example.com/alternate.js [NC,L]
On lines 3 and 4, replace example.com with your own domain name. Note the backward slash before the periods.
On the last line, line 5, replace http://www.example.com/alternate.js with the URL to the JavaScript file with the alternate content.
After putting the lines into the .htaccess file, immediately check whether or not your own code to import JavaScript is still working.
Then further test the implementation with a link to a .js file on your domain from a web page on another domain. If you don't have a second domain, ask a friend to help you test the code.
If the link on the other domain results in importing the .js file specified in the URL at the last line of the .htaccess code, it's working.
If you own more than one domain and they share JavaScript files, or if you allow other site owners access to certain JavaScript files, the .htaccess code will need to take those domains and allowed files into account. The .htaccess code can quickly become more complicated.
In that case, get a WebSite's Secret membership and download Hotlink
Hotlink Alarm II also can protect other types of files, like ZIP and PDF by delivering alternate files, and it can provide alternate images to websites that hotlink to yours. It's a nice piece of software, a WebSite's Secret exclusive.
Will Bontrager
