Guide Control Panel

How to stop other sites hotlinking your images

Stopping other websites from loading your images directly and using up your bandwidth to do it.

iFastHosting Support Team Updated 26 August 2026 6 min read Intermediate

Hotlinking is when another website displays an image by linking directly to the copy hosted on your server, rather than uploading their own copy. Every visitor to that other page then triggers a request to your server for the image, using your bandwidth and your resources to serve someone else's content on someone else's site — with no benefit to you at all.

How to tell if it is happening to you

The clearest sign is bandwidth usage that does not line up with your own traffic — a spike in data transferred without a matching spike in visits to your actual site. Your control panel's statistics or logs may also show requests for image files coming from referrers that are not your own domain, which is a fairly direct indicator that another site is embedding your images.

Some hotlinking is legitimate and worth leaving alone

Search engine image previews, social media link previews, and some content aggregators legitimately fetch your images directly, and blocking them can mean your images fail to appear correctly where you actually want them to. If protection breaks a preview or embed you rely on, you may need to allow that specific service alongside blocking everything else.

How hotlink protection works

Protection works by checking the referrer — the site the request claims to be coming from — on each image request. If the referrer is your own domain, or blank (as with someone typing the image URL directly, or many privacy-respecting browser configurations), the request is allowed. If the referrer is a different domain, the request is blocked or, in some setups, silently swapped for a different image, such as a small placeholder or a notice image instead of the real one.

Setting it up in your control panel

Open the section of your control panel dealing with hotlink protection, which is sometimes grouped with other security settings rather than standing on its own.

Allow your own domain explicitly
Whatever list of allowed referrers the tool asks for, make sure your own domain — and any variant of it, such as with and without www — is included. Missing this step breaks images on your own site, which defeats the purpose.
Decide how a blocked request should behave
Some tools simply refuse the request outright; others let you substitute a different image, such as a small graphic saying the image is protected. Either is reasonable — a substitute image is arguably friendlier, since it at least explains what happened rather than leaving a broken image icon.
Enable protection
Save the settings and give it a short while to take effect.
Test it properly
Load a page on your own site and confirm images still appear normally. Then, from a separate page — a simple test HTML file on a different domain, or a service that lets you preview how a URL embeds elsewhere — confirm the same image is now blocked or substituted when requested from outside your domain.

Doing it manually with .htaccess

If your control panel does not offer a dedicated hotlink protection tool, the same effect can be achieved with rules in .htaccess using the rewrite module, checking the referrer against your own domain and returning a different response for anything else. This gives more precise control — allowing specific external domains, for instance — at the cost of needing to edit the rule directly rather than using a form. See how to use .htaccess if you want to go this route instead.

Referrer checking is not completely bulletproof

A referrer header can be spoofed or stripped by whoever is doing the hotlinking, so this is a strong deterrent against casual hotlinking rather than an absolute guarantee. For most sites that is more than sufficient — the goal is stopping the common case, not defending against a determined, technically capable adversary.

Is this worth doing for a small site?

If your bandwidth usage is comfortably within your plan's allowance and you have no evidence of hotlinking happening, this is not an urgent job. It becomes worth doing once you actually notice unexplained bandwidth use, or once a specific image of yours has been spotted embedded somewhere you did not put it. See what is bandwidth and how much do I need if you want a clearer sense of what normal usage looks like for a site your size before deciding whether this is actually your problem.