Stop other websites embedding your files: hotlink protection

Hotlink protection stops other websites from embedding images or other files hosted in your account and using up its bandwidth. You set it up in cPanel > Security > Hotlink Protection when the tool is available.

Set the scope

1. Save the previous configuration and enable the protection.
2. Add the authorised URLs, including your domains and any variants that use those files.
3. Enter only the extensions you need to protect, such as images. Do not extend the block to every resource without checking how they are used.
4. Decide whether to allow direct requests: this option allows the file to be requested by its URL without coming from an authorised page.
5. If you set a redirect target, make sure it is not another protected resource that would trigger the same rule again.
6. Save and test pages, feeds, CDNs, emails and integrations that embed those files.

Also test embedding from an unauthorised origin and the direct URL. cPanel documents these options.

What it does not protect

The decision is usually based on the Referer header, which can be missing or manipulated. It is not authentication, it does not protect confidential documents and it does not stop someone from downloading a copy and publishing it on another server. For private content, use real permissions and access controls.

If legitimate images disappear, check the domain variants, the referer and the privacy policies of whoever requests them. Do not conclude that an empty referer is an attack.

Disable or change it

First save the list of authorised URLs: cPanel states that it may be deleted when you disable the protection. Revert the change and check that the affected resources load before preparing a narrower rule.