Hotlink protection in Nginx and Apache: stop bandwidth theft

Hotlinking is when another website embeds your images, videos or downloads directly from your server. Their visitors load the files, and you pay for the bandwidth and CPU. Hotlink protection checks the Referer header and refuses requests coming from other sites' pages.

Before you start

• Root access to Nginx or Apache, or .htaccess access on hosting. On cPanel there is also cPanel → Security → Hotlink Protection.
• Know the limits: the Referer header can be missing (privacy settings, some apps) or faked. Hotlink protection stops casual embedding, not determined downloading.
• If you use a CDN, set hotlink protection there; requests to your origin come from the CDN.

How the check works

When a page on other-site.com embeds https://example.com/photo.jpg, the browser sends Referer: https://other-site.com/page. Your server allows requests with an empty Referer (direct visits, some privacy browsers) or a Referer from your own domains, and blocks the rest for chosen file types.

Nginx: valid_referers

location ~* \.(jpe?g|png|gif|webp|avif|svg|mp4|webm|pdf|zip)$ {
    valid_referers none blocked server_names
        example.com *.example.com
        ~\.google\. ~\.bing\. ~facebook\.com ~twitter\.com ~linkedin\.com;
    if ($invalid_referer) {
        return 403;
    }
    expires 30d;
}

• none: no Referer header at all.
• blocked: a Referer present but stripped by a proxy or firewall.
• server_names: the names in this server block's server_name.
• Entries starting with ~ are regexes; here they let search engines and social networks show previews.

This location must not be shadowed by another static-files location; see location matching order.

Show a placeholder instead of 403

if ($invalid_referer) {
    rewrite ^ /hotlink.png break;
}

Exclude /hotlink.png itself from the protected location, or it loops.

Apache and .htaccess (also LiteSpeed)

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://([a-z0-9-]+\.)?example\.com/ [NC]
RewriteCond %{HTTP_REFERER} !(google|bing|facebook|twitter|linkedin)\. [NC]
RewriteRule \.(jpe?g|png|gif|webp|avif|svg|mp4|webm|pdf|zip)$ - [F,NC,L]

• The first condition allows an empty Referer.
• The second allows your own domain and subdomains, over HTTP or HTTPS.
• [F] returns 403 Forbidden.

Place these rules near the top of .htaccess, before CMS rules like WordPress's front controller. Add any other domains you own (staging, old domains still in use).

Things to allow

• Your own domains and subdomains, including www and a CDN hostname if it pulls via your site.
• Search engines' image search and social networks if you want rich previews.
• RSS readers and email newsletters that embed your images: they often send no Referer, which none already allows.

Test the rules

curl -sI -e https://other-site.com/ https://example.com/images/photo.jpg | head -1
curl -sI -e https://example.com/blog/ https://example.com/images/photo.jpg | head -1
curl -sI https://example.com/images/photo.jpg | head -1

Expect 403, 200 and 200. Then load your own pages in a browser and check that every image still appears.

Troubleshooting

• Your own images broken: your domain variant (www, subdomain, http vs https) is missing from the allow list.
• Rules do nothing: a CDN serves the files, or another location/rule handles images first.
• Social previews missing: allow the network's crawler domains or user agents.

FAQ: hotlink protection

Does hotlink protection hurt SEO?

Not if you allow search engines. Image search still works.

Can people still download my images?

Yes, by visiting them directly. Hotlink protection only stops embedding on other sites.

Should I protect CSS and JavaScript too?

Usually not needed, and it can break legitimate tools. Focus on large media files.

Next steps

• Plesk hotlink protection
• .htaccess security rules
• Bandwidth vs port speed