Hotlinking
Definition
Hotlinking, also called inline linking or bandwidth theft, happens when a page on one domain references a file stored on another using a direct link. Their HTML contains an img, video or script tag pointing at your address, so each of their page views fires a request at your host. Nothing is copied and nothing is broken — the web was designed to work exactly this way, which is why hotlinking happens by accident at least as often as on purpose. The consequence is that your traffic now scales with their popularity instead of yours, and all of it counts against your bandwidth limit. It is worth separating the freeloading case from the ordinary one, where a partner embeds a logo you gave them and everything is working as intended.
Why It Matters
The arithmetic turns unpleasant quickly. A 500 KB product photo embedded in a forum thread that draws 20,000 views a month pulls 10 GB out of your allowance for a page you have never seen. If your plan caps traffic, the file eventually stops serving — and it stops for your own visitors too, not only theirs. Then there is the presentation problem: your image is now part of somebody else's design, framed by their advertising, with no attribution and nothing you can change about it except the file sitting at your end of the link.
How It Works
A browser loading their page finds a tag whose src is your address and issues an ordinary GET to your host. That request carries a Referer header naming the page it came from, and that header is the hook on which both detection and blocking hang. The host compares the Referer against a list of permitted domains and answers 403 Forbidden when there is no match, a technique generally sold as hotlink protection. Requests with no Referer at all — someone typing the address, or a privacy tool stripping the header — are normally let through, because blocking them breaks the file for legitimate visitors. The blunter options are renaming the file, which breaks every embed simultaneously, and serving a different image to unrecognised referrers.
Real-World Example
A photographer hosts a 1.2 MB portfolio shot on 99helpers behind studio-north.99helpers.site. Two months later the edge analytics show an unfamiliar referrer accounting for 60 per cent of her traffic: a recipe blog using the photo as a page header. She replaces the file at the same address with a watermarked 90 KB version. Her own site serves its own copy and is unaffected, the blog now displays her watermark, and her monthly traffic halves overnight.
Common Mistakes
- ✕Blocking every request that arrives without a Referer — that also blocks people who typed the address in and anyone using a browser that strips the header
- ✕Renaming the hotlinked file to break the embed — every legitimate link to it breaks in the same instant
- ✕Treating a partner's embed as theft — if you gave them the address, the fix is a rule that allows their domain, not a 403
Related Terms
Direct Link
A direct link points at a file's bytes rather than at a page about the file. Request it and you get the file itself, with its own Content-Type header and nothing wrapped around it.
Bandwidth Limit
A bandwidth limit is the total volume of data a host will send out on your behalf in a billing period, usually a month. It counts what leaves, not what is stored, so a tiny file can exhaust it and a huge one may never touch it.
Image Hosting
Storing image files somewhere on the web and serving them at addresses that can be dropped straight into an img tag, an email or a marketplace listing. The useful output is the address, not the upload.
CDN
A content delivery network: a set of servers spread across the world that keep copies of your files and answer each visitor from somewhere close to them. It is the service; the machines it runs on are its edge network.
HTTP Status Code
An HTTP status code is the three-digit number a server returns at the head of every response, saying what happened to the request. It is the first thing on the first line — a 200 means here is the file, a 404 means there is nothing at that address.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →