title: 403 forbidden while trying to open a webpage on a website from another website
body: <p>I have hosted a static webpage on Gitlab pages. The URL of the webpage is <code>myname.gitlab.io</code></p>
  <p>I have another website hosted with <code>hostgator</code> which has the URL <code>&quot;mysecondwebsite.com&quot;</code>. <code>&quot;mysecondwebsite.com&quot;</code> has thousands of static html pages hosted on the various paths like <code>&quot;mysecondwebsite.com/charts/folder1/1.html&quot;</code>, <code>&quot;mysecondwebsite.com/charts/folder1/2.html&quot;</code>, <code>&quot;mysecondwebsite.com/charts/folder1/3.html&quot;</code> &amp; so on.</p>
  <p>I don't want <code>&quot;mysecondwebsite.com&quot;</code> to be accessible directly nor the pages in it. Hence, I've enabled hotlink protection which works as expected. Now, I also want to allow access to <code>&quot;mysecondwebsite.com&quot;</code> <strong>ONLY FROM</strong> <code>myname.gitlab.io</code>. This website has list of hyperlinks which when clicked should open anapprpriate page in  <code>&quot;mysecondwebsite.com&quot;</code>. To achieve this, I've entered the following in <code>.htaccess</code> file on hostgator which isn't helping. I see 403 forbidden</p>
  <pre><code># IP to allow
  order allow,deny
  deny from all
  allow from gitlab.io
  </code></pre>
  <p>Current hotlink protection settings -</p>
  <pre><code># DO NOT REMOVE THIS LINE AND THE LINES BELOW HOTLINKID:r2xGl7fjrh
  RewriteEngine on
  RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mysecondwebsite.com/.*$      [NC]
  RewriteRule .*\.(.*|jpg|jpeg|gif|png|bmp|tiff|avi|mpeg|mpg|wma|mov|zip|rar|exe|mp3|pdf|swf|psd|txt|html|htm|php)$ https://mysecondwebsite.com [R,NC]
  # DO NOT REMOVE THIS LINE AND THE LINES ABOVE r2xGl7fjrh:HOTLINKID
  </code></pre>
  <p>I am in no way an expert with web hosting. Please could I get some help to get this working.</p>
  <p><strong>UDPATED htaccess</strong></p>
  <pre><code>Options All -Indexes
  
  RewriteEngine on
  RewriteCond %{HTTP_REFERER} !^http(s)?://((myfirstwebsite\.com)|((www\.)?mysecondwebsite\.com))/ [NC]
  RewriteRule .* - [F]
  </code></pre>
  <p><strong>HTTP LIVE HEADER DUMP</strong></p>
  <pre><code>https://mysecondwebsite.com/charts/thisfolder/thisfile.html
  Host: mysecondwebsite.com
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate, br
  Alt-Used: mysecondwebsite.com
  Connection: keep-alive
  Upgrade-Insecure-Requests: 1
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: cross-site
  Sec-Fetch-User: ?1
  
  GET: HTTP/2.0 403 Forbidden
  cache-control: private, no-cache, no-store, must-revalidate, max-age=0
  pragma: no-cache
  content-type: text/html
  content-length: 699
  date: Wed, 06 Apr 2022 07:13:17 GMT
  server: LiteSpeed
  content-security-policy: upgrade-insecure-requests
  alt-svc: h3=&quot;:443&quot;; ma=2592000, h3-29=&quot;:443&quot;; ma=2592000, h3-Q050=&quot;:443&quot;; ma=2592000, h3-Q046=&quot;:443&quot;; ma=2592000, h3-Q043=&quot;:443&quot;; ma=2592000, quic=&quot;:443&quot;; ma=2592000; v=&quot;43,46&quot;
  X-Firefox-Spdy: h2
  ---------------------
  https://mysecondwebsite.com/favicon.ico
  Host: mysecondwebsite.com
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0
  Accept: image/avif,image/webp,*/*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate, br
  Alt-Used: mysecondwebsite.com
  Connection: keep-alive
  Referer: https://mysecondwebsite.com/charts/thisfolder/thisfile.html
  Sec-Fetch-Dest: image
  Sec-Fetch-Mode: no-cors
  Sec-Fetch-Site: same-origin
  
  GET: HTTP/3.0 404 Not Found
  content-type: text/html
  last-modified: Mon, 28 Mar 2022 13:48:20 GMT
  etag: &quot;999-6241bca4-dfd29bee5117e228;br&quot;
  accept-ranges: bytes
  content-encoding: br
  vary: Accept-Encoding
  content-length: 911
  date: Mon, 04 Apr 2022 10:11:14 GMT
  server: LiteSpeed
  content-security-policy: upgrade-insecure-requests
  alt-svc: h3=&quot;:443&quot;; ma=2592000, h3-29=&quot;:443&quot;; ma=2592000, h3-Q050=&quot;:443&quot;; ma=2592000, h3-Q046=&quot;:443&quot;; ma=2592000, h3-Q043=&quot;:443&quot;; ma=2592000, quic=&quot;:443&quot;; ma=2592000; v=&quot;43,46&quot;
  X-Firefox-Http3: h3
  ---------------------
  </code></pre>