Add hotlink protection and security headers in Plesk

Two quick wins for any website on Plesk: stop other sites from using your bandwidth by embedding your images (hotlinking), and send HTTP security headers that tell browsers how to protect your visitors. Both are configured per domain.

Before you start

• Access to the domain's Apache & nginx Settings and hosting settings.
• HTTPS working on the domain; see SSL It!.

Hotlink protection

1. Go to Websites & Domains, open the domain and look for Hotlink Protection (in the domain's Security or More section, depending on version).
2. Click Switch On.
3. Add your own domains and any CDN hostnames to the list of friendly domains.
4. Choose the file extensions to protect, for example jpg, jpeg, png, gif, webp, mp4.
5. Save.

If the option is not shown in your Plesk version, the same result can be achieved with an nginx rule using valid_referers in Additional nginx directives; see redirects and directives.

Security headers

Open Hosting & DNS → Apache & nginx and add to Additional nginx directives:

add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always;

• HSTS – enable it with the toggle in SSL It! rather than by hand, once all subdomains work on HTTPS.
• Content-Security-Policy – very effective against script injection, but must be tailored to every external script, font and analytics service you use. Start with Content-Security-Policy-Report-Only and watch browser console reports before enforcing.
• Permissions-Policy – disable browser features you do not use, such as camera or geolocation.

Note that headers added in nginx apply to responses nginx serves. If Apache serves dynamic pages in proxy mode, nginx still adds the headers to the proxied responses with always.

Test

• Check headers: curl -I https://example.com.
• Open the site and the browser developer console to confirm nothing is blocked by your CSP.
• Test hotlink protection by embedding an image from another domain.

Troubleshooting

• Site layout broken after CSP: the policy blocks a needed resource; switch to report-only and add the missing source.
• Embedded iframes stopped working: X-Frame-Options blocks framing from other domains – intended, unless you embed your own site elsewhere.
• Own images broken: a domain or CDN is missing from the friendly list, or blank referrers are blocked.

Next steps

• ModSecurity WAF.
• Security Advisor.
• Cloudflare with Plesk.