Knowledge Base

Understanding and Enabling Hotlink Protection

Hotlink Protection prevents other websites from directly linking to files like images, videos, etc., hosted on your server. When another website embeds your files on their pages, they consume your server's bandwidth and processing power while stealing your content, a practice known as bandwidth theft or leeching.

Enabling Hotlink Protection ensures that your value assets are only accessible when visitors are physically browsing your authorized domains. This safeguards your hosting resources, maintains site performance, and prevents unauthorized automated scrapers from mining your data.

How to Enable Hotlink Protection in cPanel?

Follow these step-by-step instructions to configure and activate Hotlink Protection across your hosting panel.

Step 1: Navigate to the Security Panel

1. Log into your cPanel dashboard.
2. Locate the search bar at the top or scroll down to the Security section.
3. Click on the Hotlink Protection icon.

Step 2: Verify Allowed Domains

1. Look at the text box labeled URLs to allow access.
2. Verify that your primary domain and any associated subdomains, e.g., example.com, demo.example.com, etc., are listed.

Note: cPanel automatically populates and manages this list for all domains configured on your account.

Step 3: Define Protected File Extensions

1. Locate the text field labeled Block direct access for the following extensions (comma-separated).
2. Ensure all file formats you wish to shield are listed here, separated strictly by commas without spaces, e.g., jpg,jpeg,gif,png,pdf, etc.

Step 4: Restrict Direct URL Requests

1. Locate the checkbox labeled Allow direct requests.
2. Leave this checkbox UNCHECKED.

Why this matters: Keeping this unchecked ensures that if a user or automated bot tries to paste the direct URL path of a protected file into a browser or script, the server will block it with a 403 Forbidden Error instead of serving the file, but this can affect your Google SEO rank.

Step 5: Save and Activate

1. Scroll down to the optional Redirect the request to the following URL field, leave this blank to deliver a standard security error to leeched requests, or add your desired URL.
2. Click the blue Submit button to save your extension configurations.

Scroll back to the top of the page and click the Enable button. The status message will update to read: Hotlink protection is currently enabled.