Hotlinking is when another website displays your images (or videos, PDFs and other files) by linking straight to the copy on your server. Their page looks good, and your Instant Access Internet Services hosting account pays for the bandwidth. cPanel's Hotlink Protection stops this by refusing file requests that come from sites you haven't approved. This guide shows you how to turn it on without accidentally blocking your own site.
Before you start
- Hotlink protection checks where a request comes from (the "referrer"). It works well against casual hotlinking, but it isn't a way to stop people saving images they can see.
- It applies to your whole website, including subdomains.
- If your site is behind a CDN or you embed your images elsewhere (a newsletter, an online store, a second site), you'll need to allow those addresses too.
How to turn on Hotlink Protection
- In cPanel, go to Security > Hotlink Protection.
- Click Enable. A confirmation page appears; click Go Back.
- Look at the URLs to allow access list. cPanel fills it with your own domain. Check it includes every address your site is visited on - with and without
www, and bothhttp://andhttps://- plus any subdomains you use, for example:http://example.com https://example.com http://www.example.com https://www.example.com
- Add one line for each other site that's allowed to show your files (for example your online store's domain).
- In Block direct access for the following extensions, list the file types to protect, separated by commas, for example
jpg,jpeg,gif,png,webp,bmp. You can addmp4,mp3orpdfif those are being hotlinked. - Leave Allow direct requests ticked. This still lets someone open an image by typing its address or clicking a link in an email - without it, many legitimate visitors would be blocked.
- Optional: in Redirect the request to the following URL, enter a page or small image to show instead of the hotlinked file. Leave it blank to simply block the request.
- Click Submit.
Test it
- Clear your browser cache and browse your own website. Every image should still load. If any are missing, a domain variation is missing from the allowed list.
- If you know a site that was hotlinking your images, check their page again - your images should no longer appear (it may take a refresh or their cache to clear).
How to turn Hotlink Protection off
Go to Security > Hotlink Protection and click Disable. Disabling deletes your list of allowed URLs, so copy it somewhere first if you've added a lot of entries.
Troubleshooting
Images disappeared from my own website
Your site is being visited on an address that isn't in the allowed list - most often the https:// or www version, or a subdomain. Add the missing address and click Submit. If you're not sure, temporarily click Disable, confirm your images come back, then enable it again with a complete list. Also see WWW or Non-WWW: How to Redirect Your Domain to redirect everyone to one version of your domain.
Images are missing from social media previews or Google Images
Sites like Facebook, Google and email apps fetch your images to show previews. Those requests don't come from your own site, so strict rules can block them. Keeping Allow direct requests ticked handles most of these. If previews are still broken, add the service's domain to the allowed list or protect fewer file types.
My site broke after enabling it
Hotlink Protection adds rules to your public_html/.htaccess file. If you also edit that file by hand, keep the hotlink section intact. If something goes wrong, click Disable to remove the rules, then see How to Show Hidden Files (.htaccess) in cPanel File Manager to check the file.
Can I see how much bandwidth I'm using?
Yes - see How to View Website Statistics with AWStats and Bandwidth for bandwidth and visitor statistics.
Related guides
- How to View Website Statistics with AWStats and Bandwidth
- WWW or Non-WWW: How to Redirect Your Domain
- How to Show Hidden Files (.htaccess) in cPanel File Manager
- Understanding cPanel Statistics: Disk Space, Bandwidth and Databases
Still stuck? Open a support ticket and the Instant Access Internet Services team will help.
