Allow Iframe but restrict direct access

RewriteEngine On
RewriteCond %{HTTP_REFERER} !example.net
RewriteCond %{REQUEST_URI} ^/wp-content/uploads/protected
RewriteRule . – [F]