In website terms, hotlinking is

the use of a linked object, often an image, from one site into a web page belonging to a second site. The second site is said to have an inline link to the site where the object is located.

What does anti-hotlinking mean? How can a website prevent requests originating from some other server?


The usual technique is to use mod_rewrite as suggested by Josh. This isn't perfect but removes the majority of hot-linking so would probably do the job you are looking for.

There is a more complex way that almost guarantees no hot-linking: make sure each visitor needs to use a different URL to get the same image:

  1. Place the image files where the web server can not ordinarily see them (so they can not be directly addressed by a simple URL)
  2. When you send out a page that uses an image, generate a random code to refer to this instance of this image (for instance use your scripting language's UUID functions to return a random UUID, or use a salted hash of the current time in milliseconds since epoc), and drop an row into a database that contains this code and the name+location of the image file and the current time
  3. Return to the calling browser an image tag or link that is a call to a script with this code in the URL
  4. When the browser makes a request to this script, lookup the right image in the DB using the code and return its data
  5. Regularly delete the rows from the database if they are older than an hour or so. This means the link to the image is only valid for an hour. For inline images you can make this shorter - say only keeping them around for a minute or two reducing the time the link to the image is valid.

This had a couple of major disadvantages though:

  • You page must be scripted, turning what could be a plain static HTML page into something that requires a chunky script processor like PHP to be run
  • Each request for one of the protected images is also a scripted response instead of a simple request for a static object. You can get around this by using filesystem links instead of database entries if your OS and filesystem support this - just create a link to the image in a know spot on the filesystem that the web server can see, and send a normal URL to that - so you send out an image tag that refers to http://yourhost/images/random-code-blah-123456.jpg. Then you just need to clear out the links regularly instead of deleting database rows. If you don't want to (or can't) deal with links, just copy the file - but this imparts a lot of extra I/O load for each page request.
  • You are hitting your database more then you would otherwise need to. The symlink/hardlink/file-copy method gets around this though.
  • The images are available for hot-linking during the time-out period. You can work around this by using part of the caller's IP address as part of the code for the file. Don't use all the IP address though as many users are stuck behind proxies that may make their address change randomly (you should be safe to use the first half of the address though unless the viewer is using a global anonymising proxy network like Tor). This only works for the fully scripted approach though.

If this all sounds like far too much work, you are probably right. Go with the mod_rewrite option - it is generally effective enough, imposes far far less load on your server(s) and is much less work to setup.

  • Chunky script processor?
    – James Watt
    Aug 7 '10 at 12:45
  • @James: Sorry, I know I should avoid colloquialisms on public postings... By "chunky" I'm just meaning "big" - a script processor like PHP the loading of which can be quite expensive (in terms of RAM use mainly) in CGI mode, and if using fCGI or mod_php maintaining enough interpreters to deal with all the extra requests that would be needed would also be costly in the amount of RAM needed. Aug 8 '10 at 10:43
  • A former place I worked used a Cisco SSL VPN that did just this to URL links. Not to prevent hotlinking, but to make sure no browser history could refer to potentially sensitive information once the SSL VPN session timed out or was logged off.
    – ultrasawblade
    Mar 17 '11 at 20:58
  • This approach kills client side caches, which would mean more requests to your server, which means you are not gaining server resources by eliminating hot linking. Mar 18 '11 at 5:45
  • @Sripathi: most of the time blocking hotlinking isn't about saving bandwidth: it is about not losing ad views and other things associated with viewing the object via your page instead of on its own or form within someone else's page, though you are not wrong in that these techniques can increase bandwidth requirements if the same visitor views the same page more than once. Mar 18 '11 at 14:05

You can prevent hotlinking with a decent .htaccess file that checks the referrer.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.com/angryman.gif [R,L]
  • It's not a guaranteed protection. Many browser plugins suppress today the referrer info for privacy. There is really no sure way to prevent hot-linking.
    – harrymc
    Aug 7 '10 at 8:11
  • @harrymc - well, many sites refuse to provide the image unless the referrer IS present AND is local. Generally, they tell people to turn off referrer blocking when people complain they can't see the images.
    – Fake Name
    Aug 7 '10 at 9:41
  • @Fake Name - some proxies and plugins that mess around with referrers are wise to this though. Instead of just removing the referrer or replacing it with something meaningless they put in the hostname of the image request. There are ways around this too, of course (for example keeping your images on a different domain to the pages that refer to them) Aug 7 '10 at 12:29
  • 1
    There are ways around everything, this is decently easy to set up, has a very low load on the server, and sufficiently effective to prevent people from blindly copying images.
    – Josh K
    Aug 8 '10 at 5:29
  • 1
    Indeed, it's practically impossible to prevent hotlinking - but you can make it hard enough that people think twice. Most of the time people don't realise the harm, hotlink protection will make them rethink.
    – Phoshi
    Mar 17 '11 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.