It can also be trivially defeated by using an <iframe> with a <meta http-equiv="refresh" content="1;url=hxxp://hotlinked/image.gif" /> Removing the allow for t

It can also be trivially defeated by using an <iframe> with a <meta http-equiv="refresh" content="1;url=hxxp://hotlinked/image.gif" /> Removing the allow for the null-referrer ^$ fixes it for this, but breaks access for user agents that don't send Referer.