Does hotlinking image protection hurt search engines indexing?

Question

Several websites are hotlinking my images, I want to block and prevent hotlinking to my website images.

And, I was going to use standard hotlink prevention code in .htaccess:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

However, some of the blog and forum threads had suggested to separately add search engines in an allow list like the following:

RewriteCond %{HTTP_REFERER}  !^http?://([^.]+\.)?google\.   [NC]
RewriteCond %{HTTP_REFERER}  !^https?://([^.]+\.)?facebook\.    [NC]

Do I need to explicitly add every search engine & social media while applying hotlink prevention code in .htaccess? Does this effect on my website images crawling?

Or, is there any better way to protect images from hotlinking?

Answer 1

Do I need to explicitly add every search engine & social media...

Potentially, yes. However, it does depend on how the third party (search engine / social media platform) fetches/caches your images.

If Google image search is a concern then you will need to punch a hole in your hotlinking protection to allow google.com as the Referer. Whilst googlebot will be able to crawl your images initially (because of your first condition that checks for an empty Referer), when a user clicks on an image in "image search", a direct request is made to your site, which sends a Referer of the form https://www.google.com/.

RewriteCond %{HTTP_REFERER}  !^http?://([^.]+\.)?google\.   [NC]

Rather importantly, you are missing the s in https in the above regex, so this negated condition will always succeed and https://www.google.com will be blocked. Google is HTTPS everywhere these days, so you don't need the ? for an optional s. I don't think you need the NC flag either (only malformed bots send uppercase Host headers):

RewriteCond %{HTTP_REFERER}  !^https://([^.]+\.)?google\.

Aside: I have seen http://www.google.com (note HTTP, not HTTPS) used as the Referer by malicious bots, so if anything, these should be blocked.

Or, is there any better way to protect images from hotlinking?

There is no other way. By its very nature, it is unreliable and prone to error.

You should probably only implement hotlinking prevention if it becomes a problem for your site, hampering your site performance or consuming all your bandwidth (or maybe they hotlink everything!). It can even benefit you SEO-wise. I would rather a site hotlinked a few of my images (which I still control), rather than copy and reuse my images without attribution (which I have no control over).

Answer 2

No. Hotlinking just prevents people loading your images compliments of your bandwidth. As long as you don't block the directory of the images to get indexed, then all is good.

Side note. Most hosting companies have an option to prevent hotlinking in the control panel.