How to enable and configure hotlink protection
Last updated on 9 December 2023
“Hotlinking” is embedding content from one website on another website. Often, hotlinking is perfectly fine. For instance, there is nothing wrong with embedding a YouTube video on your website (provided the owner of the video has enabled that option). However, hotlinking can also be done without permission. Someone might see lovely photo on your website and decide to embed it on their website, using the original image URL.
This practice is bad for both your website and the website on which the resource is embedded. If someone embeds an image from your website then you pay for the bandwidth every time the image is downloaded. And the website on which the photo is embedded can’t be sure that the image continues to be available. If you remove the image then it no longer shows on the website doing the hotlinking.
You can stop websites hotlinking to your website by adding a rule to your .htaccess file. On cPanel servers you can also enable and configure hotlink protection via the control panel.
Hotlinking example
To illustrate how hotlink protection works, let’s imagine that I own example.com and that another website, penguins-unite.io, has embedded an image on its website that is hosted on my server:
<!DOCTYPE html>
<html lang="en-gb">
<head>
<meta charset="utf-8" />
<title>Penguins Unite!</title>
</head>
<body>
<h1>The online meeting place for all penguins</h1>
<img src="http://example.com/wp-content/uploads/2023/12/king-penguins.jpg" width="640" height="427" alt="It's a penguin!" />
</body>
</html>
As the owner of example.com I can prevent the image is downloaded from my server. In cPanel, you can do so via Security » Hotlink Protection. On the page you can simply click the Enable button to enable hotlink protection. The only other thing to check are the URLs and extensions that should be protected.
By default, cPanel’s hotlink protection blocks jpg, jpeg, gif, png and bmp files. You might want to tweak the list. For instance, bmp files are very rare nowadays, while webp images are becoming increasingly popular. Similarly, if you host your own video files then you can add extensions such as mp4, ogv and webm to the list. Or, if you use custom fonts then you can add the font extensions as well. It all depends on the content on your website.
When you enable hotlink protection cPanel adds a rule to the .htaccess file for the domains you specified. The default rule looks like this:
RewriteCond %{HTTP_REFERER} !^http://example.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://example.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.example.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.example.com$ [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - [F,NC]
The hotlinked image is now no longer showing on the penguins-unite.io website. Instead, it is blocked with an error 403 (“forbidden”).
Redirecting URLs
You can also redirect rather than block hotlinking requests. If you do so via cPanel, do not click the “Allow direct requests” checkbox. It will break your hotlinking rule. Just enter the URL (or the path to) the destination.
You can have lots of fun with this feature. For instance, here I redirect hotlinking requests to an image named do-not-hotlink.jpg.
The rule in the .htaccess file is similar to the previous one. The only difference is that the rewrite rule now redirects to the replacement image.
RewriteCond %{HTTP_REFERER} !^http://example.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://example.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.example.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.example.com$ [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ /wp-content/uploads/2023/12/do-not-hotlink.jpg [R,NC]
The replacement image (do-not-hotlink.jpg) is a photo of a My Little Pony character. So, the penguins-unite.io website now shows an image of a cute little pony rather than a penguin-related image.
If you look at the requests for the page you see that the king-penguins.jpg file now has the status code 302, which is a redirect. The redirect goes to the image of the pony.
Hanlon’s razor
Although hotlinking is a nuisance, it is usually done out of ignorance rather than malice. Someone probably used a WYSIWYG editor and simply copied and pasted the URL of an image on your website, without realising that the image will be downloaded from your server. Blocking the requests is easy and should be sufficient. Please don’t use the redirect feature to display offensive content on the website that is hotlinking.
Featured Blogs
How to Choose a Dedicated Server for UK Businesses
Dedicated servers offer numerous advantages for businesses, including optimal performance, speed, reliability, and enhanced security. However, choosing a dedicated server provider for a business can be a challenging task, especially if you’re unsure what factors to consider. Dedicated server requirements will differ based on your type of business type, whether you’re in e-commerce, gaming, media, …
Comparing Dedicated Servers with VPS Hosting
Many businesses begin by managing their own websites or using shared hosting, but as their needs grow, they often require a more robust solution to enhance performance, security, and speed. Whether you run an e-commerce store, an online gaming platform, an IT consultancy, or a news website; increased traffic and business growth may lead you …
Why Choose UK Dedicated Server Hosting for Your Business?
As companies scale their operations and seek to maintain a seamless online presence, many consider upgrading to a dedicated server. This option offers greater control, enhanced security, and improved performance; all crucial elements for growing businesses. Given these advantages, it’s no surprise that dedicated server hosting has become a popular choice. Deciding if it’s worth …
Managed Dedicated Server Hosting for eCommerce Businesses in the UK
As more UK shoppers increasingly turn to online platforms to make their purchases, having a good online platform as an eCommerce business is essential. As your eCommerce operation grows, you may encounter challenges such as higher traffic, slower loading times, and potential security issues, all of which can negatively impact the visitor experience on the …
How Managed Dedicated Servers Can Elevate Your Online Security
Businesses today are confronted with an increasing array of online threats that can compromise sensitive data, disrupt operations, and harm reputation. As cyber threats continue to grow in both frequency and sophistication, the potential for online breaches can pose a significant risk to any business. Failing to implement robust security measures can lead to data …
Managed vs Unmanaged Dedicated Servers; Which is Right for Your Business?
Many businesses rely on hosting providers for dedicated servers to ensure optimal performance, security, and control. Unlike shared hosting, where resources are divided among multiple users, a dedicated server offers exclusive access to all of the server’s resources. This makes it ideal for businesses that experience high traffic, require substantial resources, or operate in data-sensitive …
Dedicated Server Basics; Everything You Need to Know
With businesses receiving more traffic on their websites than ever before, as more people engage online, the need for a dedicated server has become vital. While smaller businesses can often use shared hosting and virtual private servers, larger businesses with high traffic typically require more advanced and comprehensive hosting solutions; dedicated servers emerge as the …
Tips for Creating a User-Friendly Website
When designing a website, prioritising user-friendliness is crucial for success, especially for businesses offering products or services. A user-friendly website is not just nice-to-have; it’s a necessity. It ensures that visitors can easily navigate your site, enjoy a visually appealing interface, experience fast loading times, and seamlessly interact with the content. However, creating a user-friendly …
Discussing the Importance of Server Scalability for Business Growth
For business growth, meeting the increasing demands of customers can be challenging. It’s essential to keep pace with these demands without compromising on performance. As a business expands, it typically encounters higher traffic volumes, larger data storage needs, and the requirement to support more complex applications which is where server scalability becomes crucial. Server scalability …
Effective Ways to Improve the Credibility of Your Website
Now, more than ever, the credibility of a business’s website is crucial for building trust with the target audience and achieving business goals. A credible website not only attracts visitors but also keeps them engaged, encourages conversions, and encourages long-term relationships. A strong online presence is essential for businesses to thrive and compete effectively. Investing …
What our clients say
Great real person support – direct phone number, usually the same individual so any problems are handled by the same people. Excellent.
