Hotlinking: Stop Other Sites Using Your Images and Bandwidth

Short answer: Hotlinking is when another website shows your images, videos or files by linking directly to the files on your server instead of hosting its own copies. Every view on their site downloads the file from yours, using your bandwidth and server resources, and often your work without permission. You can block it with a referrer rule in Apache or Nginx, or with the hotlink protection setting of your CDN. Allow requests with no referrer and from search engines and your own domains, so you do not break image search, link previews or visitors with strict privacy settings.

What hotlinking is and why it matters

When a page includes an image, the browser downloads it from whatever address the src attribute points to. If a forum post, a scraper site or an online shop uses <img src="https://yourshop.com/wp-content/uploads/product.jpg">, every visitor of that page fetches the image from your server.

For a small image on a small site this hardly matters. It starts to matter when:

Your bandwidth is limited or billed. Hosting plans and some CDNs charge for traffic. A popular post elsewhere can use more of your bandwidth than your own visitors do.
The files are large, such as high-resolution photos, PDFs or videos.
Your server is small. Extra requests compete with your own visitors and can slow your site down.
Your content is being used without permission, for example product photos on a competitor’s or a fake shop’s pages.

Hotlinking is also a common sign of content scraping. Sites that copy your text often hotlink your images too, because downloading them is extra work. If you find hotlinked product images on an unfamiliar shop, check whether that shop also uses your name or descriptions, as that may be a fraud site.

How to spot hotlinking

Server access logs. Filter requests for image files and look at the Referer field. Requests whose referrer is a domain other than yours are hotlinks.
Hosting or CDN statistics. Many panels show top referrers and bandwidth by file. A single image with unusual traffic is a hint.
Reverse image search. Search engines with image search can show pages that display your image; check whether those pages load it from your domain.
Bandwidth spikes that do not match your own visitor numbers.

Do not over-react to a few foreign referrers. Translation services, web archives, RSS readers and people sharing your page in a chat tool can all appear in logs, and they are usually harmless or even useful. What you are looking for is repeated, heavy use of your files on pages you do not control.

Before blocking, make a short list of legitimate referrers: your own domains and subdomains, staging sites, payment pages that show your logo, marketplaces where you list products with images from your server, and partner sites you have agreed with.

Who must not be blocked

Hotlink protection works by checking the Referer header that browsers send with requests. Getting the exceptions right is what separates a good rule from one that hurts you:

Empty referrer. Visitors who open an image directly, some privacy tools and browsers, apps, email clients and many feed readers send no referrer. Pages with a strict Referrer-Policy, including yours, may also omit it. Always allow requests without a referrer.
Your own domains, with and without www, and any other domains you use.
Search engines. Image search results often display images from your server. Blocking them can remove your images from image search, which costs traffic. Search engine crawlers themselves usually send no referrer, but image result pages do.
Social networks and messengers. They usually fetch your Open Graph image on their own servers and show their copy, so a correct rule rarely affects them, but test your link previews after enabling protection. Our guide to Open Graph tags explains how previews are built.

How to block hotlinking on Apache

On Apache, including most shared hosting, you can add rules to the .htaccess file in your site’s root:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$ (allow empty referrer)
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourshop\.com/ [NC] (allow your domain)
RewriteCond %{HTTP_REFERER} !(google|bing|duckduckgo)\. [NC] (allow major search engines)
RewriteRule \.(jpe?g|png|gif|webp|avif)$ - [F,NC] (refuse other requests for images)

The [F] flag returns 403 Forbidden. Some site owners prefer to serve a small replacement image instead, but that still uses bandwidth and can look like vandalism on someone else’s page; a plain refusal is simpler. Many hosting panels also have a “hotlink protection” option that writes similar rules for you.

How to block hotlinking on Nginx

Nginx has a built-in directive for this. In the server block of your site:

location ~* \.(jpe?g|png|gif|webp|avif)$ {
valid_referers none blocked server_names *.yourshop.com ~\.google\. ~\.bing\. ~\.duckduckgo\.;
if ($invalid_referer) { return 403; }
}

none allows requests without a referrer, blocked allows referrers that a proxy or firewall has stripped, and server_names allows your own host names. Add other legitimate domains to the list. Make sure this location block does not replace caching headers you already set for images; combine them in one block if needed.

How to test your rule

A hotlink rule that is slightly wrong can break your own website, so test it straight after enabling it. With curl you can send any referrer you like:

Foreign referrer: curl -I -e https://other-site.example/ https://yourshop.com/images/logo.png should return 403.
Your own domain: the same command with -e https://yourshop.com/ should return 200. Try the www and non-www versions.
No referrer: the command without -e should return 200.
Search engine: a referrer such as https://www.google.com/ should return 200.

Then open a few pages of your site in a private browser window and check that every image loads, including images in the shop, the blog and any page builder sections. Look at the browser console for blocked requests. Finally, share one of your pages in a messenger or social network and confirm that the preview image still appears.

Remember caches. A CDN or browser may have stored a 403 response during testing, or still serve images that should now be blocked. Purge the CDN cache for image files after changing the rule, and repeat the tests. If you later add a new domain, such as a country site that uses images from the main shop, add it to the allowed list before launch.

Hotlink protection with a CDN

If your images are served through a CDN, configure protection there, because requests may never reach your server. Most CDNs offer a hotlink protection toggle or a rule based on the referrer header. The same exceptions apply: allow empty referrers, your domains and search engines. Check which file types the setting covers and whether it applies to your image CDN or only to the main domain. Our article on whether you need a CDN explains how CDNs handle images and bandwidth in general.

Some CDNs and image services also support signed or expiring URLs. These are useful for paid downloads, private documents and videos, where a simple referrer check is not strong enough, because the referrer header can be faked by anyone who wants to.

When hotlinking is not the real problem

Hotlink protection limits who can embed your files, but it does not stop copying. Anyone can download an image and upload it elsewhere. If the issue is stolen content rather than bandwidth:

Contact the site owner and ask for removal or attribution.
Send a copyright takedown notice to the hosting provider or the platform where the content appears.
For fake shops using your photos and brand, report the site to the hosting company and to search engines’ spam and phishing reporting forms.
Consider subtle watermarks for valuable photography.

Also look at your own image sizes. Serving images that are much larger than needed makes hotlinking more expensive and slows your own pages. Our guide to image optimization shows how to reduce file sizes.

How Site AI Audit helps

Site AI Audit does not check who embeds your images, but it reports several things that decide how much a hotlink costs you: how heavy your home page is, whether text files are compressed, how long your server takes to respond and Google PageSpeed results for mobile, together with security headers and the SSL certificate. You can run a free check, and the pricing page lists the plans with monitoring.

The bottom line

Hotlinking lets other sites show your files at your expense. Check your logs or CDN statistics for foreign referrers, then block image requests from unknown sites with a referrer rule in Apache, Nginx or your CDN. Always allow empty referrers, your own domains and search engines, and test image search and link previews afterwards. For truly valuable files use signed URLs, and for stolen content use takedown requests rather than technical tricks.

FAQ

Does blocking hotlinking hurt SEO?

Not if you allow search engines and empty referrers. A rule that blocks image search result pages can remove your images from image search, so test after enabling it.

Can someone bypass hotlink protection?

Yes. The referrer header can be removed or faked, and anyone can download and re-upload your image. Protection stops casual embedding, not determined copying.

Should I show a replacement image to hotlinkers?

You can, but it still uses some bandwidth and may cause disputes. Returning 403 Forbidden is simpler and clearer.

Will link previews on social networks still work?

Usually yes, because platforms fetch the image on their own servers, often without a referrer. Test a few links after enabling protection.

Is hotlinking illegal?

Embedding someone else’s images without permission can infringe copyright depending on the country and context. Technical protection and takedown notices are the practical tools for site owners.