Hotlink Protection Explained: When to Block It and When to Allow It

Hotlinking is when another website displays your image by linking straight to the file on your server — without ever copying it to their own. Visitors see your picture, but the bandwidth bill and server load land entirely on you, and you get none of the traffic. Whether that's a problem depends entirely on what the image is for.

How hotlinking actually works

Every time a browser loads an `<img>` tag, it sends a request to whatever URL is in the `src` attribute — it doesn't matter which domain that URL points to. If a forum post, a marketplace listing, or a random blog embeds your image's direct link instead of uploading their own copy, every visitor to that page triggers a request to your host, not theirs.

For a single embed, this is a rounding error. For an image that goes viral on a high-traffic forum, it can mean thousands of requests you never see any benefit from.

When to block it

• Bandwidth-sensitive hosting. If your image links sit behind a metered or capped hosting plan, uncontrolled hotlinking can push you over your limit.
• Paid or premium content. Product photography, licensed stock, or anything you're monetizing shouldn't be freely embeddable elsewhere.
• Off-brand or low-quality placements. An image embedded next to spam or low-trust content reflects on the source, even without any traffic benefit.

When to allow it

• Shareable content built for embedding. Infographics, memes, and diagrams designed to spread often work best precisely because they're easy to hotlink — that's how they travel.
• Attribution-driven traffic. If the embedding page credits and links back to you, the exposure can outweigh the bandwidth cost.
• Low-traffic, non-critical images. Not every hotlink is worth the effort of blocking — some just aren't big enough to matter.

What actually stops hotlinking

Hotlink protection is typically enforced at the server or CDN level, by checking the Referer header on each image request and rejecting ones that don't come from an approved domain. This is a hosting-level configuration, so the right move is to check what your specific host or CDN offers before assuming a feature exists — see our guide on how CDN and API access works for developers for the underlying mechanics.

If protecting the image itself (not just the bandwidth) is the real goal — for example, stopping outright reuse rather than just embedding — that's a copyright question more than a hotlinking one. Our guide on protecting uploaded images from copyright theft covers that side of it.

Frequently asked questions

What exactly is hotlinking?

Hotlinking is when a website embeds an image by linking directly to the file on another site's server, instead of hosting its own copy. The image loads, but the bandwidth and server load are billed to the original host, not the site displaying it.

Is hotlinking illegal?

Not on its own — it's a technical practice, not a legal one. It becomes a problem when the image itself is used without permission, which is a copyright issue rather than a hotlinking issue.

How do I know if my images are being hotlinked?

Check your traffic or bandwidth logs for repeated requests to the same image file coming from a domain other than your own — that's the clearest sign an image is embedded elsewhere without a visit to your site.