404/500 error on content images if Referer header is from another domain [closed]

It has nothing to do with WordPress. Your server is configured to refuse access from other domains. All you need to enable CORS Origin.

This will allow request from other domains. But it will decrease security. You might want to change the * (allow all) to your sub domain. Just put it in your .htaccess file.

<IfModule mod_headers.c>
  <FilesMatch "\.(jpg|png|gif)$">
    Header set Access-Control-Allow-Origin "*"
  </FilesMatch>
</IfModule>

Related Posts:

  1. How to redirect all HTTP requests to HTTPS
  2. Best way to eliminate xmlrpc.php?
  3. HTTP Security Headers in wp-config
  4. Downloading File from Outside Web Root
  5. Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
  6. Any any insecure http:// URLs left in wordpress?
  7. Specific Page/Post Need to Stay Non SSL
  8. https images not displaying
  9. What is the difference between a cer, pvk, and pfx file?
  10. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  11. Error `sec_error_revoked_certificate` when viewed in Firefox only
  12. Convert .pfx to .cer
  13. Why should I use the esc_url?
  14. How to remove rest api link: in http headers?
  15. Why escape if the_content isnt?
  16. Full path disclosure on rss-functions.php
  17. What to use instead of wp_kses() in user output
  18. Are the default salts secure?
  19. is_email() VS sanitize_email()
  20. Subscribe to email for security fixes?
  21. How to escape custom css?
  22. Understanding SVG vulnerabilities in WordPress related to a specific fix
  23. Moving wp-config.php: Can this be done after site launch?
  24. How to secure or disable the RSS feeds?
  25. Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
  26. Make password invalid once logged out of password-protected page
  27. How to get WordPress to save upload file beyond web root [closed]
  28. Is security a problem in WordPress?
  29. Moving wordpress out of the public directory
  30. Logout via Subdomain, non-wordpress page on a different server?
  31. wp_remote_get() not retrieving pages properly
  32. If Modified Since HTTP Header
  33. How can I tell who changed the password?
  34. Why am I sometimes getting a 404 error when I try to update a page with Elementor?
  35. WordPress website Security [closed]
  36. Do I need to use the esc_html() function on hard coded links?
  37. Can’t reset WordPress password
  38. Is the “lost password” feature truly a vulnerability?
  39. Disabling the X-Redirect-By response header
  40. Frontend Password change
  41. Is it possible to reduce the minimum character length for passwords?
  42. Handling email piping attachments and detecting unsupported file types
  43. Why Better WP security plugin returns 418 I’m a Teapot “error”?
  44. site get login attempts after htaccess ip restriction
  45. Is it good security advice to install wordpress in subdirectory but link to root?
  46. Why was my blog post inserted lot’s of ad links by others?
  47. Moving wp-config.php up 2 levels
  48. How Could I sanitize the receive data from this code
  49. WordPress SQL Injections through User Agent
  50. Should I Worry About SQL Injection When Using wp_insert_post?
  51. Is there a way for a user to have an alias?
  52. Security threat with `home_url`?
  53. When is wp_set_password() called or how to capture a password
  54. How to protect wp-admin through .htaccess?
  55. Something is unescaping all html entities before output to browser [closed]
  56. Headers Content-Security-Policy CSP Major Issue
  57. Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
  58. How to get WordPress to send Password Reset Link Email instead of New Password?
  59. WordPress 502 | Header Upstream send too big
  60. Verifying that I have fully removed a WordPress hack?
  61. Large Session Tokens
  62. How to change permissions of WordPress and/or apache on macOS securely?
  63. Using an Encryption class in a WordPress Plugin
  64. Limit Login Attempts BEFORE PHP is executed?
  65. Safe to say WordPress security releases don’t have database upgrades
  66. Config file with no Keys..?
  67. How much should I worry about these messages?
  68. Security concerns with external links
  69. Uploading .webm format on WordPress results in security guidline breach and fail
  70. fail2ban to prevent Brute Force Attacks on WordPress?
  71. .htaccess password protection bypassed
  72. Session Cookie security questions
  73. How to give the same error message when the wrong password or wrong username is used?
  74. Storing FTP details in wp-config.php
  75. Spam injected in w3 total cache page cache [closed]
  76. Adding Security Keys?
  77. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  78. Secret keys in SCM
  79. Secure Server after configuration
  80. Uploading attachment (pdf) and prevent download for anonymous user
  81. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  82. Block JSON access over the net
  83. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  84. Scan multiple websites for malware that are in same webhost root?
  85. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  86. Security: AWS (shared hosting) claims template file malicious
  87. Enable CORS for getting an inline SVG by URL
  88. Modify wp headers on specific page
  89. How to check whether a site has been compromised without browsing into it?
  90. My site thinks it’s secure when it is fact not
  91. Is it possible to only have the admin interface bind to the local loopback?
  92. PHP Code Sniffer – WordPress VIP Coding Standards
  93. Trying to understand nature of hacking
  94. Default installation permissions for wp-config.php
  95. Correct setup to block file modifications from hackers
  96. checking the form submit in right order
  97. Our security auditor is an idiot. How do I give him the information he wants?
  98. I am under DDoS. What can I do?
  99. SSH keypair generation: RSA or DSA?
  100. WordPress – tracking options