Hotlink Protection: How to Stop Others Stealing Your Images and Bandwidth

Imagine you have uploaded beautiful product photos to your site, and then someone else builds their own site and shows those same images — but instead of downloading them and hosting them themselves, they load them directly from your server. Every time someone visits their site, your server sends the image and burns your bandwidth and resources. This is called hotlinking (or "bandwidth theft") and it affects more sites than owners realise.

Why hotlinking is a problem

At first glance it seems harmless, but the consequences are concrete. First, you pay for the bandwidth and server resources for content shown on someone else's site — you are essentially sponsoring a competitor. Second, if their page becomes popular, your server can get overloaded and slow down for your real visitors. Third, you lose control of context: your image can appear next to content you do not want to be associated with.

How hotlinking actually works

Every image on your site has its own address, for example your-site.com/images/product.jpg. When someone puts that address in an img tag in their HTML, the visitor's browser requests the image directly from your server. The server does not know the request comes from another page — it just sees someone asking for a file and sends it. The solution is to teach the server to check where the request is coming from.

How to protect yourself

• Server rules (referrer check): the most effective method. The server checks which domain an image request comes from and allows only requests from your domain and search engines. Everything else is blocked or redirected.
• Protection via CDN: if you use a CDN, you can usually enable "hotlink protection" in a couple of clicks and list the allowed domains.
• WordPress plugins: there are add-ons that apply referrer rules without hand-editing the configuration, handy for beginners.
• Watermark and lower resolution: does not prevent hotlinking, but reduces the motive to steal and protects your brand.

Be careful not to block useful things

When you set up protection, always allow access to Google, Bing and social networks. If you block too aggressively, your images will not be able to show in Google Images or in the link preview when someone shares your article on social media — and that is traffic you want. So always test after configuring.

How this fits into site speed

Hotlink protection is part of the wider story of using resources efficiently. If you already care about images, it is smart to optimise them properly too — we cover that in our guide to image optimisation for the web and in the article on WebP and AVIF formats. And since referrer rules belong to the server's protective layer, it is worth reading how a WAF protects your site from more serious attacks.

What you get with us

On SEOhosting.rs plans you get a free global CDN with an option for hotlink protection, WAF/DDoS protection and NVMe disks — all in one place, with support if you need help configuring. Take a look at our hosting plans or read more about SEO hosting.