Hotlinking, also called inline linking, is when a page loads an asset such as an image from someone else's server by pointing its src at that URL instead of hosting a copy. Every view of the embedding page costs the original host bandwidth and requests.
Why it matters
A popular post or forum thread can multiply your bandwidth bill or push a small host past its transfer quota, and a slow origin may then take your own pages down. It also lets third parties show your images without credit. For your own site's reliability, the reverse risk matters: assets you hotlink can disappear or change.
Example
Block hotlinking by checking the Referer header. In nginx:
location ~* \.(jpg|jpeg|png|gif|webp)$ {
valid_referers none blocked server_names ~\.google\. ~\.bing\.;
if ($invalid_referer) { return 403; }
}Referer can be missing or forged, so this deters casual use but is not a security control. Many CDNs offer a built-in hotlink protection setting.
Common mistakes
- Blocking empty referers, which breaks privacy-minded browsers and some apps.
- Forgetting to allow search engines and your own subdomains.
- Hotlinking critical assets from third parties you do not control.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.