Hotlinking happens when another website embeds an image, video, or other file straight from your server instead of hosting a copy themselves. Every time someone visits that other page, your server serves the file, using up your bandwidth and server resources for traffic that has nothing to do with your own site. Hotlink protection blocks requests for your files that do not come from your own domain, so the image simply fails to load on the other site.
In cPanel
- Log in to cPanel and open Hotlink Protection under the Security section.
- Confirm the list of URLs to allow access includes your own domain and any subdomains you use, such as yourdomain.com and www.yourdomain.com.
- In the Block direct access for the following extensions field, list the file types to protect, for example jpg,jpeg,png,gif,webp,pdf.
- Optionally set a Redirect the request to the following URL value if you want blocked requests to show a specific image or page instead of failing silently.
- Click Enable.
In DirectAdmin
- Log in to DirectAdmin and open Hotlink Protection under the Advanced Features section.
- Add your domain to the list of allowed referrers if it is not already present.
- Enter the file extensions to protect, such as jpg jpeg png gif webp.
- Click Save to turn on protection.
Things to check afterward
- If you use a content delivery network or a separate subdomain to serve images, add that domain to the allow list too, or it will start blocking your own site's images.
- Search engine and social media preview crawlers sometimes fetch images without a referrer header at all. Most hotlink protection setups still allow these through, but if link previews on social platforms stop showing your images after enabling this, that is the likely cause.
Hotlink protection only affects direct file requests from other websites. It does not stop someone from downloading your image and re-uploading a copy to their own server, which is a separate concern with no server-side fix.