Hotlinking drains your server bandwidth when other websites embed your images directly. This guide shows you how to block hotlinked images using Apache .htaccess rewrite rules, protecting your hosting resources without affecting legitimate visitors.<\/p>\n\n\n\n
Hotlinking happens when someone embeds your image on their website by pointing directly to your server URL rather than hosting the file themselves.<\/p>\n\n\n\n
For example, if another site uses this code:<\/p>\n\n\n\n
<<\/span>img<\/span> <\/span>src<\/span>=<\/span>"https:\/\/yoursite.com\/images\/photo.jpg"<\/span> <\/span>\/><\/span><\/span><\/code><\/pre><\/div>\n\n\n\nYour server delivers the image every time their page loads. Multiply that across dozens of sites and high-traffic pages, and you’ll see CPU spikes, bandwidth overages, and slower performance for your actual visitors.<\/p>\n\n\n\n
Why Hotlink Protection Matters<\/h2>\n\n\n\n
Hotlinking creates two problems:<\/p>\n\n\n\n
Resource theft.<\/strong> Every hotlinked request consumes your server’s CPU, memory, and bandwidth allocation. On Shared Hosting plans, excessive hotlinking can trigger resource limit warnings or account throttling.<\/p>\n\n\n\nContent misuse.<\/strong> Your images appear on other websites without attribution or permission, often in contexts you didn’t authorize.<\/p>\n\n\n\nBlocking hotlinks stops both issues while still allowing your images to load normally for your own site visitors.<\/p>\n\n\n\n
Block Hotlinking with .htaccess<\/h2>\n\n\n\n
The most reliable method for preventing hotlinking is adding Apache mod_rewrite rules<\/a> to your .htaccess<\/code> file. These rules run at the server level before PHP or WordPress even loads, making them efficient and universally compatible.<\/p>\n\n\n\nBasic Hotlink Protection<\/h3>\n\n\n\n
This code blocks direct access to common image formats from external domains:<\/p>\n\n\n\n
RewriteEngine<\/span> <\/span>on<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^$<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^https:\/\/(www\\.)?yoursite\\.com\/.*$<\/span> [NC]<\/span><\/span>\nRewriteRule<\/span> <\/span>\\.(jpg|jpeg|gif|png|bmp|webp)$<\/span> <\/span>-<\/span> [F]<\/span><\/span><\/code><\/pre><\/div>\n\n\n\nReplace yoursite.com<\/code> with your actual domain.<\/p>\n\n\n\nHow it works:<\/strong><\/p>\n\n\n\n\nRewriteEngine on<\/code> enables Apache’s rewrite module<\/li>\n\n\n\nRewriteCond %{HTTP_REFERER} !^$<\/code> allows requests with no referrer (direct browser access)<\/li>\n\n\n\nRewriteCond %{HTTP_REFERER} !^https:\/\/(www\\.)?yoursite\\.com\/.*$ [NC]<\/code> allows requests from your own domain<\/li>\n\n\n\nRewriteRule \\.(jpg|jpeg|gif|png|bmp|webp)$ - [F]<\/code> returns a 403 Forbidden error for blocked image requests<\/li>\n<\/ul>\n\n\n\nThe [NC]<\/code> flag makes the domain match case-insensitive. The [F]<\/code> flag sends an HTTP 403 status code.<\/p>\n\n\n\nAllow Multiple Domains<\/h3>\n\n\n\n
If you manage multiple sites or want to allow specific partner domains:<\/p>\n\n\n\n
RewriteEngine<\/span> <\/span>on<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^$<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^https:\/\/(www\\.)?yoursite\\.com\/.*$<\/span> [NC]<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^https:\/\/(www\\.)?partnerdomain\\.com\/.*$<\/span> [NC]<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^https:\/\/(www\\.)?anotherdomain\\.net\/.*$<\/span> [NC]<\/span><\/span>\nRewriteRule<\/span> <\/span>\\.(jpg|jpeg|gif|png|bmp|webp)$<\/span> <\/span>-<\/span> [F]<\/span><\/span><\/code><\/pre><\/div>\n\n\n\nAdd one RewriteCond<\/code> line for each domain you want to whitelist.<\/p>\n\n\n\nRedirect to a Warning Image<\/h3>\n\n\n\n
Instead of showing a broken image, redirect hotlinkers to a replacement image explaining the policy:<\/p>\n\n\n\n
RewriteEngine<\/span> <\/span>on<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^$<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^https:\/\/(www\\.)?yoursite\\.com\/.*$<\/span> [NC]<\/span><\/span>\nRewriteRule<\/span> <\/span>\\.(jpg|jpeg|gif|png|bmp|webp)$<\/span> <\/span>https:\/\/yoursite.com\/images\/hotlink-warning.png<\/span> [R,L]<\/span><\/span><\/code><\/pre><\/div>\n\n\n\nCreate a simple hotlink-warning.png<\/code> image with text like “This image is hosted at yoursite.com” and upload it to your \/images\/<\/code> directory. The [R,L]<\/code> flags trigger a redirect and stop processing further rules.<\/p>\n\n\n\nThis approach maintains visual consistency on the offending site while making it clear the image belongs to you.<\/p>\n\n\n\n
Redirect to a Custom Error Page<\/h3>\n\n\n\n
For non-image hotlinking attempts (like direct video or PDF access), send users to an HTML page:<\/p>\n\n\n\n
RewriteEngine<\/span> <\/span>on<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^$<\/span><\/span>\nRewriteCond<\/span> <\/span>%{HTTP_REFERER}<\/span> <\/span>!^https:\/\/(www\\.)?yoursite\\.com\/.*$<\/span> [NC]<\/span><\/span>\nRewriteRule<\/span> <\/span>\\.(jpg|jpeg|gif|png|bmp|webp|mp4|pdf)$<\/span> <\/span>https:\/\/yoursite.com\/restricted.html<\/span> [R,L]<\/span><\/span><\/code><\/pre><\/div>\n\n\n\nWhere to Add .htaccess Rules<\/h2>\n\n\n\n
Your .htaccess<\/code> file lives in your website’s root directory, typically public_html<\/code> or www<\/code>.<\/p>\n\n\n\nTo edit via cPanel File Manager:<\/strong><\/p>\n\n\n\n\n- Log into cPanel.<\/a><\/li>\n\n\n\n
- Open File Manager<\/strong> under the Files section<\/li>\n\n\n\n
- Navigate to your site’s root directory<\/li>\n\n\n\n
- Right-click
.htaccess<\/code> and select Edit<\/strong><\/li>\n\n\n\n- Add the rewrite rules at the top of the file, before any existing WordPress or application rules<\/li>\n\n\n\n
- Save changes<\/li>\n<\/ol>\n\n\n\n
To edit via SSH:<\/strong><\/p>\n\n\n\nnano<\/span> <\/span>\/home\/username\/public_html\/.htaccess<\/span><\/span><\/code><\/pre><\/div>\n\n\n\nAdd the rules, then save with Ctrl+O<\/code> and exit with Ctrl+X<\/code>.<\/p>\n\n\n\nDirectory-Specific Protection<\/h3>\n\n\n\n
To protect only certain directories (like \/wp-content\/uploads\/<\/code> for WordPress sites), create or edit the .htaccess<\/code> file in that specific folder:<\/p>\n\n\n\nnano<\/span> <\/span>\/home\/username\/public_html\/wp-content\/uploads\/.htaccess<\/span><\/span><\/code><\/pre><\/div>\n\n\n\nThis narrows protection to uploaded media files without affecting theme images or other assets.<\/p>\n\n\n\n
Testing Your Configuration<\/h2>\n\n\n\n
After adding rules, verify they work:<\/p>\n\n\n\n
\n- Test from your own site.<\/strong> Images should load normally when viewing your pages<\/li>\n\n\n\n
- Test direct browser access.<\/strong> Navigate to an image URL directly (like
https:\/\/yoursite.com\/images\/photo.jpg<\/code>). This should still work because the referrer is empty<\/li>\n\n\n\n- Test external embedding.<\/strong> Create a test HTML file on another domain with an
<img><\/code> tag pointing to your image. The image should either break (with 403 rules) or show your replacement image (with redirect rules)<\/li>\n<\/ol>\n\n\n\nCheck your Apache error logs<\/a> for any issues. Blocked requests appear with 403<\/code> status codes.<\/p>\n\n\n\nPerformance Impact<\/h2>\n\n\n\n
Hotlink protection rules execute before PHP, so they add minimal overhead. On WordPress Hosting<\/a> or VPS plans with thousands of images, you’ll actually improve performance by reducing unauthorized bandwidth consumption.<\/p>\n\n\n\nIf you notice any slowdown, confirm mod_rewrite<\/code> is enabled. On InMotion VPS and Dedicated Servers, this module loads by default. On other hosting environments, contact Support if rewrites aren’t processing.<\/p>\n\n\n\nWhen to Use Hotlink Protection<\/h2>\n\n\n\n
Implement these rules if:<\/p>\n\n\n\n