| docs

Appearance

Hotlink Protection ​

Hotlink Protection

URL: /client/hotlink-protection - in the sidebar under Security.

Hotlink protection prevents other websites from directly linking to files on your server. This protects your bandwidth and ensures only authorized sources can access your content.

Manage hotlink protection status for your domains. Use the search bar to find specific domains quickly.

The table displays:

  • Domain: Your domain name
  • Actions: Enable to turn hotlink protection on for the domain, and for a protected domain Configure to change its settings and Disable to turn it off

Each domain can be toggled independently to enable or disable protection.

Use the pagination controls to select items per page and navigate through multiple pages.

When you click Enable for a domain, a configuration form appears with the following fields:

  • URLs to allow access (list) - Add URLs that are allowed to link directly to your files (your own domain is included by default)
  • Block extensions (text) - File extensions to protect from hotlinking (e.g. jpg, jpeg, gif, png, bmp)
  • Allow direct requests (checkbox) - When enabled, visitors can access files by entering the URL directly in the browser
  • Redirect URL (text) - The URL visitors are redirected to when hotlink protection blocks a request

Form buttons: Enable, Cancel

When a change is refused ​

Since panel 1.9.3, enabling, configuring, or disabling hotlink protection first checks where the domain's website folder and its .htaccess file really lead. If the website folder, a folder above it, or the .htaccess file has been replaced with a symbolic link that leads outside your home directory, the change is refused and nothing is stored or written:

The folder this change writes to, or a file in it, leads outside your hosting account, for example through a symbolic link. Nothing was changed.

Replace the link with a real folder or file, or point it inside your own home directory, then try again. A link that stays inside your home directory is accepted, also when it points outside the website folder.

If the panel cannot complete this check because the server agent does not answer, the change is refused with "Check that the agent is running, then try again." and nothing is changed. If the message persists, contact your hosting provider.

When the settings are stored but the web server rules could not be written, the panel shows a warning, for example "Hotlink protection was saved, but the web server rules were not applied.", with the next step. Apply, update, or remove the protection again once the reported cause is cleared.

Over the API ​

Since panel 1.9.4, GET, PUT, and DELETE /api/client/domains/{domain_id}/hotlink-protection on the client REST API read, enable or change, and disable a domain's hotlink protection. Enabling without fields takes this page's defaults: the domain itself over HTTP and HTTPS as the allowed referrers, and the common image types as the blocked extensions. When protection is already on, only the fields you send change. When the change is stored but the web server rules cannot be rebuilt, the answer carries status: partial with the reason and the next step, as When a change is refused describes for this page. The endpoints need this page's feature in your hosting plan; see API Keys.