Please help me config the htaccess file so it will deny access from all (include typing the url in the address bar) unless it was refer from a specific site (link was click from a specific site i.e. xya123.com)

this is the current content in .htaccess

<Files *.mfh>
order allow,deny
deny from all
</Files>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^/]+)/?$ download.php?file=$1 [L]

I change it to:

<Files *.mfh>
order allow,deny
deny from all
allow from xya123.com
</Files>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^/]+)/?$ download.php?file=$1 [L]

or

<Files *.mfh>
order allow,deny
deny from all
allow from ip address
</Files>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^/]+)/?$ download.php?file=$1 [L]

but it didn't work, please help

After you read the article, make sure to read the comments. People discuss limiting access so that it must come from specific websites.

http://corz.org/serv/tricks/htaccess.php