1

Several websites are hotlinking my images, I want to block and prevent hotlinking to my website images.

And, I was going to use standard hotlink prevention code in .htaccess:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

However, some of the blog and forum threads had suggested to separately add search engines in an allow list like the following:

RewriteCond %{HTTP_REFERER}  !^http?://([^.]+\.)?google\.   [NC]
RewriteCond %{HTTP_REFERER}  !^https?://([^.]+\.)?facebook\.    [NC]

Do I need to explicitly add every search engine & social media while applying hotlink prevention code in .htaccess? Does this effect on my website images crawling?

Or, is there any better way to protect images from hotlinking?

2 Answers 2

2

Do I need to explicitly add every search engine & social media...

Potentially, yes. However, it does depend on how the third party (search engine / social media platform) fetches/caches your images.

If Google image search is a concern then you will need to punch a hole in your hotlinking protection to allow google.com as the Referer. Whilst googlebot will be able to crawl your images initially (because of your first condition that checks for an empty Referer), when a user clicks on an image in "image search", a direct request is made to your site, which sends a Referer of the form https://www.google.com/.

RewriteCond %{HTTP_REFERER}  !^http?://([^.]+\.)?google\.   [NC]

Rather importantly, you are missing the s in https in the above regex, so this negated condition will always succeed and https://www.google.com will be blocked. Google is HTTPS everywhere these days, so you don't need the ? for an optional s. I don't think you need the NC flag either (only malformed bots send uppercase Host headers):

RewriteCond %{HTTP_REFERER}  !^https://([^.]+\.)?google\.

Aside: I have seen http://www.google.com (note HTTP, not HTTPS) used as the Referer by malicious bots, so if anything, these should be blocked.

Or, is there any better way to protect images from hotlinking?

There is no other way. By its very nature, it is unreliable and prone to error.

You should probably only implement hotlinking prevention if it becomes a problem for your site, hampering your site performance or consuming all your bandwidth (or maybe they hotlink everything!). It can even benefit you SEO-wise. I would rather a site hotlinked a few of my images (which I still control), rather than copy and reuse my images without attribution (which I have no control over).

2
  • Many websites look like auto blogging has hot-linked to my images and Some SEO auditing tools have shown that these websites are toxic to my website's SEO. Now, is it a good idea to manually Disavow these websites instead of blocking hotlinking.
    – knilkantha
    Mar 6, 2019 at 8:31
  • Ah, if these websites are actually considered "toxic" and are detrimental to your search ranking then you will need to Disavow them (or get them removed). Hotlink protection won't help you in this regard. In this case, it's the very presence of the link that is the problem, not the fact they are stealing your images. However, these images links aren't ordinary anchors - so whether they affect SEO directly is debatable. If they are a genuine problem then GSC will report this and provide the URLs to Disavow.
    – MrWhite
    Mar 6, 2019 at 9:34
0

No. Hotlinking just prevents people loading your images compliments of your bandwidth. As long as you don't block the directory of the images to get indexed, then all is good.

Side note. Most hosting companies have an option to prevent hotlinking in the control panel.

4
  • 1
    Wouldn't hotlink protection prevent your images from showing up in Google image search or in Facebook feeds? Mar 5, 2019 at 14:01
  • Both Google and Facebook cache images on their own servers so no hotlinking there. Mar 5, 2019 at 16:43
  • 1
    @KubaSerafinowski Google caches the thumbnails you see in "image search", however, the larger image you see when clicking the image is not cached (for any longer than your browser session) - this seems to be an ordinary client-side request for the image directly from the relevant website, which passes the Referer header (client permitting), so is therefore subject to any hotlinking restriction.
    – MrWhite
    Mar 5, 2019 at 21:53
  • "Most hosting companies have an option to prevent hotlinking" - this "option" simply edits the .htaccess file on your behalf, using similar directives as stated in the question (however, you naturally have less control).
    – MrWhite
    Mar 5, 2019 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.