Stop hotlinking and password sharing: Hotlink and Leech Protection in cPanel

Hotlinking is when another website embeds your images or videos directly from your server, so you pay the bandwidth while they get the content. Leeching is when a username and password for a protected area are shared publicly. cPanel has a tool for each, both in the Security group.

Before you start

• Check whether hotlinking is a real problem: in Awstats look at Referrers for unknown sites linking to image files.
• Know every domain that should be allowed to show your files, including www versions, addon domains and a CDN if you use one.

Enable Hotlink Protection

1. Open cPanel → Security → Hotlink Protection.
2. In URLs to allow access, check that all your domains are listed with http:// and https://, with and without www. Add your CDN hostname and services like Google Images if you want them to work.
3. In Block direct access for the following extensions, keep or edit the list, e.g. jpg,jpeg,gif,png,webp,bmp,mp4,pdf.
4. Leave Allow direct requests ticked. Without it, people who open an image URL directly (or apps that send no referrer) are blocked too.
5. Optional: in Redirect the request to the following URL, enter an image or page to show instead, for example https://example.com/hotlink.png. This file must not use a blocked extension in the same folder, or it will be blocked as well.
6. Click Enable (or Submit to save changes).

Disable Hotlink Protection

Click Disable on the same page. The rules are removed from .htaccess.

Leech Protection

Leech Protection watches a password-protected folder (see Directory Privacy) and blocks a user who logs in from too many different IP addresses within two hours, which usually means the password was shared.

1. Open cPanel → Security → Leech Protection.
2. Click the folder name you protected.
3. Set Number of Logins Per Username Allowed in a 2-Hour Period, e.g. 4.
4. Optional: URL to Redirect Leech Users such as an explanation page.
5. Tick Send Email Alert To and enter your address.
6. Tick Disable Compromised Accounts to suspend the username automatically.
7. Click Enable.

Disabled users can be re-enabled on the same page once you have given the rightful owner a new password.

Alternatives

• A CDN often offers its own hotlink protection with less configuration and caching on top.
• For members-only content on WordPress, a membership plugin with per-user accounts is better than one shared Directory Privacy login.

Troubleshooting

• Images broken on your own site: add the missing domain or protocol to the allowed URLs.
• Images broken in emails or social previews: those services may send their own referrer. Allow their domains, or untick the extension used in newsletters.
• No effect: the files are served from a CDN or another server, not cPanel.

Next steps

• Block abusive IPs
• Check bandwidth use
• Password-protect folders