Why %{HTTP_HOST} doesn't work while HTTP_HOST literal string works?

Question

I have the next Apache code to prevent hotlinking, and it works.

RewriteCond %{HTTP_REFERER} ^$ [OR]
RewriteCond %{HTTP_REFERER} !^https?://itransformer.*$ [NC]
RewriteRule /usuarios/.*\.(gif|jpe?g|png|wbmp)$ - [R=404,L]

The questions are two:

1.If I change the above to:

RewriteCond %{HTTP_REFERER} ^$ [OR]
RewriteCond %{HTTP_REFERER} !^https?://%{HTTP_HOST}.*$ [NC]
RewriteRule /usuarios/.*\.(gif|jpe?g|png|wbmp)$ - [R=404,L]

it doesn't work. %{HTTP_HOST} is equal to itransformer (in my localhost), so I don't understand why it isn't working in this way.

2. The default 404 page is shown instead of my custom 404 page that is shown in all other 404 responses. What can be happening here?

Answer 1

1. Reason why it doesn't is that you cannot use these Apache internal variables in right hand side of RewriteCond.

2. I just noticed R=404. If you need custom 404 handler then make sure you have similar line like this on top of your .htaccess:

   ErrorDocument 404 /404.php