I am trying to accomplish the following and have been unsuccessful. I would appreciate any insight. Scenario: http://www.mydomain.com/filename.html is a webpage. On this webpage I am running a viewer script that calls up documents (.png,swf, pdf) and show these to my visitors when they visit the .html page.Right now you can still access the pdg, swf, and pdf files by going to http://www.domainname.com/viewerfiles/nameoffile.png (or swf or pdf). How can I block the direct access (http://www.domainname.com/viewerfiles/nameoffile.png) but still allow the viewer resting on the html page to access the files located in the viewrfiles folder. I have tried .htaccess method but you can still access the files directly. My goal is to allow visitors to view and print the files from the webpage but I do not want scrappers and bots indexing/taking the .pdf, png, swf etc and hosting them on other sites. Thanks!
It is not possible to do what you want to do, for fundamental reasons. The user controls the client. From the server side, the server has no way to distinguish a legitimate browser that happens to be making a request for an image on the page (a case where you want to serve the image) from a malicious user who is trying to directly access the image (a case where you don't want to serve the image). These two situations are indistinguishable from the server's point of view, so the server has to behave the same way in both cases: either serve the image in both cases, or don't serve it.
You might want to revisit what you are actually trying to accomplish, and see if there is some other way to achieve it. What are you trying to prevent? What threat are you trying to protect against?
If you are trying to prevent scraping, one thing you could consider doing is making the images available only to logged-in users. You will have to decide whether that is appropriate for your site, or if it is not a good match (maybe you want the web pages and images viewable by everyone). Another option is to set up your
robots.txt file to kindly request that bots not download the images. You will be forced to rely upon the good will of the bots. Well-behaved bots and scrapers will usually obey the instructions in
robots.txt. A malicious user can always ignore the
robots.txt file and scrape your site anyway, but unfortunately, there is no way to prevent that: a malicious user will always be able to download any content that you've decided to make available to unauthenticated users. So
robots.txt is in some ways arguably about the best you can reasonably do, in most situations.
You can only decide whether a user has access to download a file from your site or not, you cannot control what a determined user does with the file. You could attempt to inspect properties of the request to recognize behavior typical of a browser embedding the file as a resource into your main page, but these properties are easily spoofable, and you are prone to breaking the normal usage of your site.
Try Googling how to use image Hotlink protection to prevent direct access to them.
If your hosting account has cPanel, their instructions are at: http://docs.cpanel.net/twiki/bin/view/AllDocumentation/CpanelDocs/HotLinkProtection
you told in your post that you are using .htaccess
I already answered this question few days ago on stackoverflow
In that post it was about images, but you can easily modify it for everything