Hotlinking is when another website displays an image of yours straight from your server, instead of keeping a copy on theirs. To their visitor it looks like an ordinary image; to you, every one of those visits is a request to your hosting account, with the usage that brings, and nothing in return. Protection does one simple thing: when a request comes from a page that is not yours, it refuses.
Switching it on in cPanel
| 1 |
Log in to cPanel (how to get in) and, in the Security section, open “Hotlink Protection”.
|
|
| 2 |
Check the list of allowed addresses. cPanel fills it in with the domains on the account. Add any variants that are missing: with and without www, on http and https, subdomains, and any other sites of yours that use these images.
|
|
| 3 |
Pick the extensions to protect. Images are the usual case (jpg, jpeg, png, gif, webp). Add others (pdf, mp4, zip) only if that is what is being taken.
|
|
| 4 |
Leave the option that allows direct requests ticked. Without it, anyone who opens the image by typing the address into the browser is refused too, and some programs that do not send the referring page stop working.
|
|
| 5 |
Optional: set a replacement image. Instead of an error, whoever hotlinks sees, say, a picture with your web address on it. Put whichever you like there.
|
|
| 6 |
Test it. Open the image directly (it should open), then place it on a page on another domain of yours (it should not show). Clear your browser cache before testing: see clearing the cache.
|
|
Three ways to do it
| Way |
When it fits |
Watch out for |
| cPanel Hotlink Protection |
The simplest: no files to edit. |
Confirm the option exists on your account and that the list includes all your domains. |
| Rules in .htaccess |
When you want fine control (per folder, per file type). |
A syntax error gives a 500 error. Make a copy first. |
| Cloudflare’s option |
If the domain already goes through Cloudflare. |
It is a Cloudflare setting, in your Cloudflare account, under Cloudflare’s terms. |
The hand-written rule for .htaccess is this (swap in your own domain and add the extensions you want):RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourcompany.com [NC]
RewriteRule \.(jpg|jpeg|png|gif|webp)$ - [F,NC]
|
Protection can also refuse people it should not. Social network previews, image search engines, feed readers and mail programs may request images in a way the rule treats as hotlinking. After switching it on, share a link to your site and check the preview (wrong preview on Facebook and WhatsApp). If you use the images in an e-mail newsletter, test that too.
|
|
Switched protection on and a legitimate image stopped showing, or you still see requests from other sites? Send us the image address.
Open a support ticket
|
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon) See plans |
Angola
Brasil
Kenya
Moçambique
Nigeria
Portugal
South Africa
United Kingdom
United States
International
