Hotlink protection stops other websites from embedding your images and files directly and using up your bandwidth.
Hotlinking is when another website shows your image, video or file by linking straight to it on your server, instead of uploading its own copy. Their visitors see the image, but your hosting does the work of sending it. Hotlink protection blocks those requests so your files only load on your own site and the sites you allow.
For example, if a forum post embeds a photo from yoursite.com/images/sunset.jpg, every person who views that post downloads the photo from your server. If the post goes viral, that can mean thousands of requests you're paying for, with no visitors to show for it.
How hotlink protection works
When a browser requests a file, it usually sends a Referer header saying which page the request came from. Hotlink protection checks that header:
- If the request comes from your own domain, or one on your allow list, the file is served.
- If it comes from somewhere else, the server refuses it, or sends a placeholder image instead.
- Requests with no referrer, such as someone typing the image address directly, are usually allowed so you don't block real visitors.
On Apache and LiteSpeed servers, this is done with rewrite rules in your .htaccess file. Control panels like cPanel write those rules for you. CDNs such as Cloudflare offer their own version too.
Why hotlink protection matters
- It saves bandwidth, which matters if your plan or CDN has limits or charges for transfer.
- It reduces server load, keeping your site fast for real visitors.
- It protects your work, since people can't easily pass off your images as their own.
Common hotlink protection mistakes
- Forgetting your own variations: allow both
example.comandwww.example.com, plus any subdomains and staging sites. - Breaking search and social previews: blocking all outside referrers can stop your images appearing in Google Images or link previews. Allow the services you want.
- Blocking RSS readers and email: newsletters that load images from your site need to be allowed.
- Protecting the wrong file types: protect images and media, not HTML pages.
Hotlink protection vs a CDN
A CDN reduces the cost of hotlinking by serving files from its own network, but it doesn't stop it. Hotlink protection stops it. Many image-heavy sites use both.