Hotlink Protection in cPanel: stop file theft

Hotlinking happens when another website embeds your files directly from your domain. Their visitors load the file from your hosting account, using your bandwidth while the other site gets the content.

What is hotlinking?

<img src="https://yourdomain.com/images/photo.jpg" alt="">

If that image tag appears on another website, every visitor to that page pulls the image from your server. Hotlink Protection blocks those external referring domains for selected file extensions.

Enable protection

1. Log in to cPanel.
2. Open Security and choose Hotlink Protection.
3. Review the allowed URLs list.
4. Review the blocked file extensions.
5. Click Enable or Submit, depending on the cPanel theme.

Allowed domains

Add every domain that should legitimately display your files. Include:

• Your primary domain and www version.
• Addon domains or subdomains that display the same assets.
• CDN hostnames, staging domains, or partner domains that are allowed to embed files.

Protected file types

Common protected extensions include jpg, jpeg, png, gif, webp, svg, mp4, mp3, pdf, and zip. Protect only the file types you actually need to restrict.

Disable protection

Return to Hotlink Protection and choose Disable. If a site still cannot load assets afterward, clear browser, CDN, and application cache.

Limitations

• Hotlink Protection relies on the HTTP Referer header, which can be missing or modified.
• Direct downloads without a referring page may still be allowed depending on your settings.
• It does not stop someone from downloading a file and uploading a copy elsewhere.
• Rules are usually stored in .htaccess, so replacing that file can remove the protection.

Related: Advanced .htaccess in cPanel: redirects, PHP settings, and access rules | How to create and manage addon domains in cPanel | Leech Protection in cPanel: limit shared password access | IP Blocker in cPanel: block abusive visitors safely

Related articles