---
title: "Hotlinking: What It Is, What It Costs, and How to Block It"
description: Hotlinking happens when another website loads your files directly from your server URL. Your bandwidth pays the bill. Here is how to prevent it.
canonical: https://penasihathosting.com/en/hosting-wiki/hotlinking
type: wiki
locale: en
updated: 2026-09-29
author: Willya Randika
---

# Hotlinking: What It Is, What It Costs, and How to Block It

## Overview

- **Summary:** Hotlinking happens when another website loads your files directly from your server URL. Your bandwidth pays the bill. Here is how to prevent it.
- **Author:** Willya Randika ([profile](/penulis/willya-randika))

## Article

## What Is Hotlinking?

Hotlinking is the practice of loading a file from someone else's server directly, instead of copying it to your own hosting. The usual targets are expensive assets: images, videos, and audio.

A concrete example: another site embeds your product photo using a URL that still points at your server. Every time one of their visitors loads the page, the browser downloads that image from your hosting — and you pay the bandwidth bill.

<Callout type="info">
💡 A simple analogy:

Imagine you pay the electricity bill, and your neighbor runs a wire from your meter to power their TV. The TV is theirs; the bill is yours. That's hotlinking: someone else uses your content while your server absorbs the cost.
</Callout>

## How Hotlinking Works

Technically, hotlinking happens because the web has no built-in rule preventing a file from being pulled across domains. The flow:

1. The hotlinking site puts an image tag whose `src` points to a file URL on your server.
2. A visitor opens their page, and the browser requests that file directly from your server.
3. Your server delivers it, your [hosting bandwidth](/en/hosting-wiki/hosting-bandwidth) is spent, and their page still shows your content.

From the server's point of view, hotlink requests look normal. The only clue is the `Referer` header — the marker showing which site the request came from. Every prevention method revolves around this header.

## Why Website Owners Should Care

Patterns you see in the real world:

* **Product images poached by competitors.** A shop lifts another store's photos for its own catalog while the traffic cost stays with the original owner.
* **Monthly bandwidth quotas.** Many shared hosting plans run on a monthly allowance or fair-use policy. Large-scale hotlinking burns that quota faster and, in extreme cases, triggers a warning from the host.
* **Aggregator bots.** Sites that pull images automatically generate hotlink traffic at scale.

The good news: hotlinking rarely breaks a website. It is a cost and control problem, not a fatal failure. But left alone, you are subsidizing someone else's content every day.

## How to Prevent and Fix It

**1. Enable hotlink protection in .htaccess.** On Apache/cPanel hosting, rewrite rules can reject image requests whose referer is not your domain, or redirect them to a placeholder. The mechanics are covered in the article on [.htaccess files](/en/hosting-wiki/htaccess).

**2. Use a CDN with hotlink protection.** Services like [Cloudflare](/en/hosting-wiki/cloudflare) offer referer rules that block specific domains from pulling your assets through a [CDN](/en/hosting-wiki/cdn) — the lightest option, since it touches no code.

**3. Check your host's [WAF](/en/hosting-wiki/waf).** Some providers already run anti-hotlink rules at the firewall level. Before configuring anything yourself, ask support whether protection is already on.

### Common Mistakes

* **Blocking all empty referers.** Plenty of legitimate requests arrive with no referer header — direct visits, chat app previews. A blanket block can break your own site's images.
* **Forgetting to allow your own domains.** Rules must whitelist your domain and subdomains, or your own pages lose their images too.
* **Blocking before investigating.** Heavy traffic from one domain is not automatically hotlinking — it may be a proper citation.

## FAQs

### Is hotlinking illegal?

In many jurisdictions no specific law bans it, but your files are still protected by copyright. Practically, the fastest resolution is a technical block via .htaccess or a CDN, not legal action.

### How do I know if my site is being hotlinked?

Check access logs in your hosting panel, or watch for anomalies: image requests wildly out of proportion to page views, or one foreign domain repeating in the referer log. cPanel's AWStats can help surface where requests originate.

### Does hotlinking affect my SEO?

Not directly. Google does not punish a site because its images are used elsewhere. What suffers is your server resources — and only if bandwidth runs out so your site slows down does SEO take the hit.