WardPane
Pobierz

Dokumentacja jest dostępna po angielsku i po rosyjsku. To jest wersja angielska.

Hotlink protection

Hotlinking means another site shows your images, plays your videos or offers your files for download straight from your server, so their page uses your bandwidth. Hotlink protection refuses such requests, and your own pages and direct visits keep working.

Turn it on in the site’s settings: Advanced tab, Hotlink protection.

Settings

Setting Default Meaning
Protected extensions jpg, jpeg, png, gif, webp, avif, svg, ico, bmp, mp4, webm, mov, mp3, wav, pdf, zip Only files with these extensions are protected. Comma separated, without the dot.
Also allow these sites empty Sites that may embed your files, one per line: partner.com, or *.example.com for a domain and all its subdomains.
Allow requests without a Referer on Keep this on, see below.

How it decides

The browser tells the server which page a file is requested from, in the Referer header. For a GET or HEAD request for a protected extension:

  1. Your site’s own domain and all its aliases are always allowed.
  2. Sites in the allowed list are allowed. *.example.com covers example.com itself and every subdomain; you can paste entries with https:// or a path, only the host name is kept.
  3. A request without a Referer (or with one that cannot be read) is allowed while Allow requests without a Referer is on.
  4. Everything else gets a plain 404.

Why requests without a Referer are allowed

Plenty of legitimate requests come without a Referer. None is sent when someone types or pastes a file’s address, opens a saved page, or uses a download manager or a mail client, and some browsers and extensions hide the referrer for privacy. Blocking these requests would hit your own visitors far more often than hotlinkers. A hotlinking page opened in a normal browser does send a Referer, so ordinary hotlinking is still stopped with this option on.

Limits

  • The check relies on a header the client writes, so a script or a server that downloads your files can leave the Referer out. It keeps your files off other people’s pages but does not prevent copying.
  • Search engines’ image results, social networks and messengers that show your pictures may be refused if they load files with their own site as the Referer. Add them to the allowed sites if that matters to you.
  • Refused requests always get the plain 404; a custom block page is not used here.