I like to have my .htaccess file located in the root directory so that all images are protected throughout your server. Here is agreat .htaccess script, similiar to the one above, just witha few different whistles and bells
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^
http://([a-z0-9-]+\.)*somesite.com/ [NC]
RewriteRule /*
http://www.yoursite.com [L,R]