Stop image hotlinking with DirectAdmin Hotlink Protection

Hotlinking is when another website embeds your images, videos or downloads directly from your server. You pay for the bandwidth, and they get the content. DirectAdmin's Hotlink Protection blocks those requests unless they come from domains you allow.

Before you start

• Your DirectAdmin login and the domain selected at the top.
• A list of domains that may legitimately display your files – your own domains, subdomains and perhaps a CDN.

Enable Hotlink Protection

1. Go to Advanced Features → Hotlink Protection.
2. Tick Enable Hotlink Protection.
3. Under Allowed URLs, check that your domain and www variant are listed; add other domains you own, one per line.
4. Tick Allow blank referrer. Some browsers, privacy tools and apps send no referrer, and blocking them breaks your own site for real visitors.
5. Set the File types to protect, for example jpg,jpeg,png,gif,webp,svg,mp4,zip,pdf.
6. Optionally enter a Redirect URL to show instead of the file – for example a small image with your logo.
7. Save.

DirectAdmin writes the matching rewrite rules into the domain's configuration (or .htaccess, depending on the web server).

Allow search engines and social sites

Image search engines and social networks generating link previews request your images with their own referrers. If you want your images to appear in image search and in link previews on social platforms, add those domains to the allowed list or keep protection only for large media files such as video and downloads.

Test it

• Open your own pages – all images must still load.
• Create a simple HTML file on another domain that embeds one of your images; it should be blocked or redirected.
• From the command line: curl -I -e https://othersite.example https://example.com/image.jpg should return 403 or a redirect.

Alternatives

• A CDN such as Cloudflare offers hotlink protection at the edge, saving server resources.
• For downloads you sell, use signed or expiring links in your application instead of plain files.

Troubleshooting

• Your own images broken: a domain, subdomain or CDN hostname is missing from the allowed list, or blank referrers are blocked.
• No effect: the web server does not process the generated rules (for example a custom Nginx setup); ask your host.
• Bandwidth still high: check access logs for other causes such as bots; see logs and statistics.

Next steps

• Password-protect directories.
• Redirects.
• Disk and bandwidth usage.