Hotlink protection
Hotlinking means another site shows your images, plays your videos or offers your files for download straight from your server, so their page uses your bandwidth. Hotlink protection refuses such requests, and your own pages and direct visits keep working.
Turn it on in the site’s settings: Advanced tab, Hotlink protection.
Settings
| Setting | Default | Meaning |
|---|---|---|
| Protected extensions | jpg, jpeg, png, gif, webp, avif, svg, ico, bmp, mp4, webm, mov, mp3, wav, pdf, zip |
Only files with these extensions are protected. Comma separated, without the dot. |
| Also allow these sites | empty | Sites that may embed your files, one per line: partner.com, or *.example.com for a domain and all its subdomains. |
| Allow requests without a Referer | on | Keep this on, see below. |
How it decides
The browser tells the server which page a file is requested from, in the Referer header. For a GET or HEAD request for a protected extension:
- Your site’s own domain and all its aliases are always allowed.
- Sites in the allowed list are allowed.
*.example.comcoversexample.comitself and every subdomain; you can paste entries withhttps://or a path, only the host name is kept. - A request without a
Referer(or with one that cannot be read) is allowed while Allow requests without a Referer is on. - Everything else gets a plain 404.
Why requests without a Referer are allowed
Plenty of legitimate requests come without a Referer. None is sent when someone types or pastes a file’s address, opens a saved page, or uses a download manager or a mail client, and some browsers and extensions hide the referrer for privacy. Blocking these requests would hit your own visitors far more often than hotlinkers. A hotlinking page opened in a normal browser does send a Referer, so ordinary hotlinking is still stopped with this option on.
Limits
- The check relies on a header the client writes, so a script or a server that downloads your files can leave the
Refererout. It keeps your files off other people’s pages but does not prevent copying. - Search engines’ image results, social networks and messengers that show your pictures may be refused if they load files with their own site as the
Referer. Add them to the allowed sites if that matters to you. - Refused requests always get the plain 404; a custom block page is not used here.