Limiting downloads on a webpage by IP address

Let's say I wanted to create a site where users could download stuff, but I only wanted them to be able to download X number of items a day, or X number of megabytes a day, and limit those downloads by IP address.

How would one go about doing that?

I'd also like to be able to allow people who pay a fee to download more.

Store each time a file is accessed in a database? So a combination of of PHP and mySQL.

So you record when it happened, what the IP address is and for reference the file they tried downloading. You'd probably want to keep the directory of files outside of the webtree as well, so people cannot directly link to it (and so would need to access your php scripts to get the file)

@Raz: Before doing this, ensure you're isp dones't has a short php execution time set to the php scripts, otherwise you'll get corrupted downloads when the users connection is not fast.

Have a database with IP address as the primary key and two other values: download count and expire time. Whenever someone downloads a file through your script, you find the entry for the IP and increment the counter (and set/reset expire time as needed).



Or just have special directory and file names that you change regularly (with the download script or a cron job) - maybe not change the actual directory, but just through a .htaccess file.

Hm... I know nothing about PHP or MySQL, and I don't even know what you mean when you say I should keep the files out of the webtree.

Maybe it would be easier to just hire someone to set it up who already knows how work with that stuff.

If anyone here does web design and knows how to code something like that, drop me an email.

Personally I wouldn't touch mySQL with a barge pole... Further more I'd store the files in the database itself so you don't need to worry about where the file location is. This way it keeps it secure and you return the file using a stored procedure. But hey... That's just me.

Or course, this would require you to have a MS server running .net and SQL (ideally SQL 2005 so you can use varbinary(max) rather than image types), and personally I think asp.net is so much nicer than PHP.

As a side note, I would not base the count on IP address, as they can be dinamyc and change. It would be neat to have a 'register' and leva downloads to autenticated users (so you can increase download counts on the user profile).

Switfy,
There's loads of free web servers that allow size and bandwidth allocation for individual users out of the box. Just Google a bit. Also limiting people by IP address is a bad idea, most people outside the US don't have fixed IP addresses and a good chunk inside the US don't either. Much better get them to create a username and password account to authenticate.

Darkheart

ziggy:
Requring people to register to use a website discourages them from using it.

You can't. For starters an IP address does not uniquely identify a user. Secondly there is no reliable mechanism to determine how or when a download is complete.

So does restricting their downloads, so that's hardly argumentative.

Your best bet is probably some sort of download manager script, similar to the ones used by free/paid file hosting sites. You'll find a few at the link below.

http://www.hotscripts.com/PHP/Scripts_and_Programs/File_Manipulation/Download_Systems/index.html

use cookies swift, you dont need php for that, you only need javascript, that is the best way and most easy for you :) no need to register no need to check IP and use php on serverside to track IP downloads etc, just use simple javascript and create cookies with it that you can read, it should take you 15 minutes to understand how to do it with javascript :)

forget IP checking, what happens if there are 10 users at same ip? ;) etc

btw swift what do you plan to offer people to download? :)

Oh Flameduck, you're so silly.




I am well aware of that. Nonetheless, limiting downloads by IP address is good enough to prevent individuals from abusing the system.




No, but I can assume the download completed, and deduct the total regardless.






There's a big difference between offering a user some free, advertsing supported content to encourage them to subscribe or purchase something, and driving them away before they've even looked at your content.

Just imagine if in order to even download the DEMO of BlitzMax you had to register. Mark would lose half his sales, at least.

Maximo:
Porn Textures of course. :-)




And what happens if they don't accept cookies, or delete them? HMMM? :-)

I just reset my modem and get a new ip, voila more free downloads from rapidshare.

I know there's always ways to work around stuff, but as long as its enough of a pain in the ass to discourage most potential abuses, that's good enough. :-)

Sure. If your target audience is someone who only uses it from their home and they have a static IP.

Anyone behind a NAT (say someone who would use it professionally) is going to get screwed.

Sure. But I don't think short changing your customers is going to win you any friends...

Wow. And the award for worst analogy ever goes to... It's not like anyone is going to want to have multiple, simultaneous downloads of the BlitzaMAX demo. More importantly if you were at someplace (lets say a school) and all the students needed to download the BlitzMAX DEMO, but because they where behind a NAT, and thus appearing to be from the same IP, they would have to take turns downloading it, he might not get any sales at all.

I think you need a more pragmatic approach. Abuse is only a real issue, if the cost of the abuse, is higher than the cost of the countermeasures.

If they're using it professionally, they can afford to pay for a subscription. That's the whole point of the thing. To give them a taste.

Putting ads on the page might bring in a little revenue, but really, what I want to do is sell the textures, not display ads.




What customers? These would be free downloads that would be limited, not paying customers. Paying customers would be paying so they get unlimited downloads or access to a full archive zip.




You're twisting my example. I didn't say anyhting about simultaneous downloads. The only thing I said was that if Mark required users to register to download the demo, fewer people would bother downloading it.

This is not a difficult concept to grasp. The more barriers you place between people and content, the fewer people who will access that content.

This is why limiting the number of free downloads per day by IP address is a better solution than requiring people to register. Registering for a website is a pain in the ass.

It's much better if the user can just start downloading as soon as they visit the site, and then be presented with a screen offering to give them unlimited downloads for a small fee. Yes, some people will end up getting screwed because they're on the same network as someone else who visited the site already that day, but let's be honest here... How the hell often do you think that's gonna happen? Not very!

Many more users (ie, ALL OF THEM) would be impacted by requiring people to register to gain access than would be impacted by allowing a certain number of downloads per day by IP adddress. This is inarguable.




Nonetheless, some method of preventing abuse needs to be implemented which isn't a pain in the ass for users. Maybe limiting downloads by IP address is not the best solution. Maybe using cookies would be sufficient to prevent most abuse, and far easier to implement*.

But requiring registration is definitely not the answer. It is both expensive to implement AND a pain in the ass.


(* Cookies won't stop website archiving programs, and that's the biggest threat for a site like this. If I have 5GB of textures and a 5GB monthly cap, one abusive person would be able to kill my bandwidth for the whole month.)

Swift just use cookies, so our Turkish friend can reset his modem all day long it wont help him :P

Swift how would I like 5010 GB montly transfer cap?

Well in that case visit www.servage.net

It's only 6 €uro per month, you should be able to afford that much. Then that way you will not have problem ;)


And also you dont have any other solution then to use damn cookies, so take my advice and implemet that if you really really must have this thing and do not decide to test servage which I warmly recomend you do ;)

Also if it is porn you are sharing, I want some of it, send it to my email address:

ceo@...

I'll let you know when I recive the email ;)

Everyone likes cookies, yum

Agree on this one, this is not ip based, only a small file on homecomputer will be storaged for a short while with remaining downloads left for that day.

Everyone could delete their cookies ofcourse, but if they have to do this every 10 files then that will keep them busy a bit.

One thing that might be a problem and is something I like to use when lazy which is copy the whole website to my computer with an application and just browse for the correct files. I used it on a site with free fonts once.

You can grab a 95th percent 10mbps server from alphared.com for $49 a month. That is a LOT of data, and its probably cheaper than the programmer time figuring out your restrictions.

Yeah but without restrictions, who's gonna pay to download? :-)

those who want that which they cant download :P But I see your business strategy swift, those who want to download all at once will buy the cd. There is simillar site like that, I'm sure you have been inspired by them, I've been downloading textures from there befor :)

Maybe another sollution which I use myself might also be an idea. I noticed that people started downloading a lot and with a lot I mean between 10 and 30GB every month and growing. My whole website plus downloads was only 2 Gigabytes big.

Because I was on the download limit a bit I started moving all download files to my home computer I use as a server anyway and linked to that. I have a 20Mbit down and 1Mbit up internet connection without a datalimit and I don't even notice that people are downloading stuff directly from my server now, which is only a Sempron 3000+ with windows XP pro installed on it.

Choosing for this means you have a server connected to the internet night and day running a webserver.
In my case I hava a static IP, but you could also link to the hostname if ip isn't static.

I think what sswift wants is similar to what the mayang textures website does. The textures are free but you only get a limited amount of downloads per ip address per day.

Even though the textures are free they do offer a service where you can buy the textures on dvd if you don't want to be restricted.

I personally got fedup with the website limit and ordered their dvd's so I can see why sswift would want to implement this.

Swift check out rentacoder.com and find a coder who can put you toghether a script that is working on IP based limitation and thats it. You can probably get away with 50$ and find some indian guy to do it for you ;) They probly already have such scripts written and can make it work for you as well :)

Something else to keep in mind: Many ISP's (like AOL, for an example) use a set of transparent proxy servers for their users -- which means that they have -x- IP's addresses that all their users get funneled through.

5 requests by the same user may look like they came from 5 different IP's, and 5 requests from different users may look like they came from the same IP, depending on which proxy servers they got routed through.

(AOL also plays havoc with web stats, for this same reason)

Yeah just whack a cookie in the browser and increment a counter for each download. If someone wants to overcome that limitation they'll spend more time in a 24 hour period clearing their cookies than downloading data, ie. they won't bother.