如何设置php网站防盗链_防盗链功能配置与资源保护方法教程

RewriteEngine On
# 允许的域名（替换为你的域名）
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain\.com [NC]
# 禁止盗链的文件类型
RewriteRule \.(jpg|jpeg|png|gif|mp4|pdf|zip)$ - [F,NC]

location ~* \.(jpg|jpeg|png|gif|mp4|pdf|zip)$ {
    valid_referers none blocked server_names *.yourdomain.com;
    if ($invalid_referer) {
        return 403;
    }
    expires 1d;
    add_header Cache-Control "public, no-transform";
}

<?php
$allowed_domains = ['yourdomain.com', 'www.yourdomain.com'];
$referer = $_SERVER['HTTP_REFERER'] ?? '';
<p>$host = parse_url($referer, PHP_URL_HOST);</p><p>if (!in_array($host, $allowed_domains) && !empty($referer)) {
http_response_code(403);
echo "非法请求，资源不可盗链。";
exit;
}</p><p>// 验证通过，输出文件
$file = 'uploads/example.pdf';
if (file_exists($file)) {
header('Content-Type: application/pdf');
header('Content-Disposition: attachment; filename="' . basename($file) . '"');
readfile($file);
} else {
http_response_code(404);
echo "文件未找到。";
}
?></p>

$token = md5($filename . 'secret_salt' . date('Ymd'));
$url = "download.php?file=$filename&token=$token&t=".time();

if ($token !== md5($filename . 'secret_salt' . date('Ymd'))) {
    die("无效链接");
}
if (time() - $_GET['t'] > 3600) { // 超过1小时失效
    die("链接已过期");
}