diff --git a/data/tpl/nginx.conf b/data/tpl/nginx.conf
index 1e4655be1..5da306f9d 100755
--- a/data/tpl/nginx.conf
+++ b/data/tpl/nginx.conf
@@ -28,7 +28,6 @@ server
     include {$OR_REWRITE}/{$SERVER_NAME}.conf;
     #REWRITE-END
     
-    
     #禁止访问的文件或目录
     location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|LICENSE|README.md)
     {
@@ -39,12 +38,14 @@ server
     location ~ \.well-known{
         allow all;
     }
-    
-    location ~ .*\\.(gif|jpg|jpeg|png|bmp|swf|js|css|ttf|woff2)$
+
+    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|js|css|ttf|woff2)$
     {
-        expires 30d;
-        error_log /dev/null; 
+        expires      30d;
         access_log /dev/null;
+        if ($invalid_referer){
+           return 404;
+        }
     }
     
     access_log  {$LOGPATH}/{$SERVER_NAME}.log main;
diff --git a/web/admin/site/site.py b/web/admin/site/site.py
index 051d0f9bd..0650bda16 100644
--- a/web/admin/site/site.py
+++ b/web/admin/site/site.py
@@ -46,12 +46,12 @@ def list():
 @blueprint.route('/add', endpoint='add',methods=['POST'])
 @panel_login_required
 def add():
-    webname = request.form.get('webinfo', '')
+    webinfo = request.form.get('webinfo', '')
     ps = request.form.get('ps', '')
     path = request.form.get('path', '')
     version = request.form.get('version', '')
     port = request.form.get('port', '')
-    return MwSites.instance().add(webname, port, ps, path, version)
+    return MwSites.instance().add(webinfo, port, ps, path, version)
 
 # 添加站点 - 域名
 @blueprint.route('/add_domain', endpoint='add_domain',methods=['POST'])
diff --git a/web/static/app/site.js b/web/static/app/site.js
index eeb3cdd3b..cd19d997f 100755
--- a/web/static/app/site.js
+++ b/web/static/app/site.js
@@ -1117,9 +1117,8 @@ function getSiteErrorLogs(siteName){
 
 //防盗链
 function security(id,name){
-	var loadT = layer.msg(lan.site.the_msg,{icon:16,time:0,shade: [0.3, '#000']});
+	var loadT = layer.msg('正在提交任务...',{icon:16,time:0,shade: [0.3, '#000']});
 	$.post('/site/get_security',{id:id,name:name},function(rdata){
-		console.log(rdata);
 		layer.close(loadT);
 		var mbody = '<div>'
 					+'<p style="margin-bottom:8px"><span style="display: inline-block; width: 60px;">URL后缀</span><input class="bt-input-text" type="text" name="sec_fix" value="'+rdata.fix+'" style="margin-left: 5px;width: 425px;height: 30px;margin-right:10px;'+(rdata.status?'background-color: #eee;':'')+'" placeholder="多个请用逗号隔开,例：png,jpeg,jpg,gif,zip" '+(rdata.status?'readonly':'')+'></p>'
diff --git a/web/utils/site.py b/web/utils/site.py
index 2b81081ab..345cc5b1f 100644
--- a/web/utils/site.py
+++ b/web/utils/site.py
@@ -180,15 +180,14 @@ class sites(object):
             mw.writeFile(path + '/index.html', 'Work has started!!!')
             mw.execShell('chmod -R 755 ' + path)
 
-    def add(self, webname, port, ps, path, version):
+    def add(self, site_info, port, ps, path, version):
         site_root_dir = mw.getWwwDir()
         if site_root_dir == path.rstrip('/'):
             return mw.returnData(False, '不要以网站根目录创建站点!')
 
-        print(webname, port, ps, path, version)
-        siteMenu = json.loads(webname)
+        site_info = json.loads(site_info)
 
-        self.siteName = self.toPunycode(siteMenu['domain'].strip().split(':')[0]).strip()
+        self.siteName = self.toPunycode(site_info['domain'].strip().split(':')[0]).strip()
         self.sitePath = self.toPunycodePath(self.getPath(path.replace(' ', '')))
         self.sitePort = port.strip().replace(' ', '')
         self.phpVersion = version
@@ -196,25 +195,20 @@ class sites(object):
         if thisdb.isSitesExist(self.siteName):
             return mw.returnData(False, '您添加的站点[%s]已存在!' % self.siteName)
 
-        pid = thisdb.addSites(self.siteName, self.sitePath)
-        if pid < 1:
+        site_id = thisdb.addSites(self.siteName, self.sitePath)
+        if site_id < 1:
             return mw.returnData(False, '添加失败!') 
 
-
         self.createRootDir(self.sitePath)
         self.nginxAddConf()
 
         # 主域名配置
-        thisdb.addDomain(pid, self.siteName, self.sitePort)
-
-        # 绑定域名配置
-
+        thisdb.addDomain(site_id, self.siteName, self.sitePort)
         # 添加更多域名
-        # for domain in siteMenu['domainlist']:
-        #     thisdb.addDomain(pid, self.siteName, self.sitePort)
+        for domain in site_info['domainlist']:
+            self.addDomain(site_id, self.siteName, domain)
 
         mw.restartWeb()
-        # return mw.returnData(False, '开发中!')
         return mw.returnData(True, '添加成功')
 
     def nginxAddDomain(self, site_name, domain, port):
@@ -957,7 +951,6 @@ class sites(object):
     def setSecurity(self, site_id, fix, domains, status, none=''):
         info = thisdb.getSitesById(site_id)
         name = info['name']
-
         if len(fix) < 2:
             return mw.returnData(False, 'URL后缀不能为空!')