Hotlink Protection
Definition
Hotlink protection is the countermeasure to hotlinking, where another site points an image or video tag straight at your address instead of hosting a copy. The visitor sees the other site; your storage does the work and your transfer is spent. Protection works by checking the Referer header, which a browser sends to say which page the request came from, and allowing only referrers you have listed — your own domains, usually, plus an empty referrer so that direct visits and bookmarks keep working. A request that fails the check gets HTTP 403 Forbidden, or sometimes a small replacement image saying where the picture really lives. The mechanism is advisory rather than absolute, because the referrer is set by the client and can be stripped or forged, but it is enough to stop ordinary copying.
Why It Matters
The bill is the obvious part. One 2 MB product photo embedded on a busy forum thread can be fetched a hundred thousand times in a weekend, which is 200 GB of transfer against your bandwidth limit for a page you do not control and get no visits from. The subtler cost is that your analytics fill with requests that were never visits, so downloads and referrers stop meaning anything. There is also a matter of control: while the file is live, the other site decides the context your image appears in, and the only way to change it is to move or replace the file, which breaks it everywhere at once. Protection puts that decision back with you.
How It Works
On each request the edge compares the Referer header against an allowlist and answers accordingly. Three cases need thinking about. An empty referrer must normally be allowed, because it covers someone typing the address, opening a bookmark, or arriving from a client that sends nothing. A referrer from your own site must be allowed or your own pages break, which is the classic way people take their images offline by accident. And a strict Referrer-Policy on the embedding page can suppress the header entirely, so some genuine hotlinks look like direct visits. Protection normally applies to file types you name, such as images, video and PDFs, rather than to HTML, so that links to your pages still work as links.
Real-World Example
A maker publishes product shots for a shop listing at ceramics-shop.99helpers.site and one photo is picked up by an aggregator with a large audience. Traffic on that single file goes to 60 GB in four days while the site itself records almost no visitors. Turning on referrer checks for images, with the shop domain allowed, drops the aggregator to a 403 within minutes and leaves the real listing untouched. Files hosted on 99helpers keep working in the shop and on direct links, which is exactly the split that was wanted.
Common Mistakes
- ✕Blocking empty referrers along with the rest — that breaks bookmarks, direct links and anyone pasting the address into a chat
- ✕Forgetting a second domain of your own, such as the www variant or a staging address — the images vanish from your own pages
- ✕Treating it as copyright enforcement — it stops the embed, not the copy, and a determined site will simply save the file and re-upload it
Related Terms
Hotlinking
Hotlinking is when another site embeds a file using its address on your host, so every visitor to their page downloads it from you. They get the image; you get the traffic bill.
Referrer-Policy
A response header that controls how much of the current URL the browser puts in the Referer header when a visitor follows a link or the page loads a resource. Values range from sending the full address to sending nothing at all.
Bandwidth Limit
A bandwidth limit is the total volume of data a host will send out on your behalf in a billing period, usually a month. It counts what leaves, not what is stored, so a tiny file can exhaust it and a huge one may never touch it.
Image Hosting
Storing image files somewhere on the web and serving them at addresses that can be dropped straight into an img tag, an email or a marketplace listing. The useful output is the address, not the upload.
Access Log
A line-by-line record of the requests a server has answered — who asked, for what, when, and what came back. It records visitors, not account activity.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →