Skip to main content
Hotlinking happens when another website embeds files (usually images) hosted on your account by linking directly to your URLs. Their visitors see the content, but your account serves the files and uses your bandwidth. Hotlink protection blocks these requests so that only your own site (and any other domains you allow) can serve your files.
1

Open the hotlink protection settings

Log in to cPanel through your client area or at yourdomain.com/cpanel. Go to Security > Hotlink Protection.
2

Enable protection

Click Enable.
3

Add allowed URLs

In the URLs to allow access field, add any domains that should be permitted to link to your files. Your own domain is usually pre-filled, but check that it’s listed. Include variations like www.yourdomain.com and yourdomain.com.If you use a CDN or a subdomain that serves content, add those too.
4

Specify protected file types

In the Block direct access for the following extensions field, enter the file extensions you want to protect, separated by commas. Common choices:jpg,jpeg,gif,png,webp,svg,bmp
5

Configure optional settings

  • Allow direct requests — select this if you want people to access files by typing the URL directly into their browser. If unchecked, direct URL access is also blocked.
  • Redirect the request to the following URL — enter a URL here to redirect hotlink attempts to a specific page (for example, your homepage or a “hotlinking not allowed” notice).
6

Save

Click Submit.
In the Hotlink Protection interface, click Disable.
Disabling hotlink protection deletes your list of allowed URLs. Save your list somewhere before disabling so you don’t have to re-enter everything if you turn it back on.

​
Things to keep in mind

  • Always include your own domain (with and without www) in the allowed URLs list. If you don’t, your own site won’t be able to display its own files.
  • If you use webmail or access cPanel at your domain, include those URLs as well (e.g. yourdomain.com:2083).
  • Hotlink protection works by checking the HTTP referer header. Some browsers, privacy tools, and VPNs strip this header, which can cause false blocks.
  • If your site uses a CDN, add the CDN’s domain to the allowed list so it can pull files from your origin server.
Hotlink protection is most useful if you host large files (images, downloads, videos) and notice unexpected bandwidth usage. If your bandwidth is fine and your content is small, you may not need it.