How to Stop Image Hotlinking (htaccess, Cloudflare and cPanel, 2026)
How can you stop image hotlinking, where other sites display your images by loading them straight from your server? It’s common with RSS scraper blogs that copy full posts: they look as if they own your content, and you pay for the bandwidth every time their pages load. We’ve blocked hotlinkers on QOT since 2012 with a simple .htaccess rule and a bright “stolen image” banner. Here’s the updated method for 2026, plus easier options in Cloudflare and cPanel.
Quick answer: To stop image hotlinking, turn on Hotlink Protection in Cloudflare (Scrape Shield) or cPanel, or add a rewrite rule to the .htaccess file in your uploads folder that blocks or replaces images when the referrer is a scraper’s domain. Allow your own domain, blank referrers and search engines, so feed readers, Google Images and social previews keep working.
Table of Contents
What is image hotlinking?
Hotlinking means another website shows your image using its URL on your server, instead of uploading its own copy. Every visit to their page downloads the image from your hosting account. On limited plans, heavy hotlinking increases bandwidth costs and can even slow or suspend your site. When the hotlinker is also a content scraper, they get free images and your content looks like theirs.
Method 1: Block hotlinking with Cloudflare
If your site uses Cloudflare, go to Scrape Shield (under Security in newer dashboards) and switch on Hotlink Protection. Cloudflare then blocks image requests from other sites while allowing search engines and sites with no referrer. Most other CDNs and some hosts (including cPanel’s Security > Hotlink Protection) offer a similar switch.
Method 2: Stop image hotlinking with .htaccess
On Apache or LiteSpeed hosting, you can block specific scraper domains only, which is what we prefer. Blocking every outside site can also break RSS readers, email newsletters and aggregators that legitimately show your images. Create a .htaccess file in wp-content/uploads/ with:
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https?://(www\.)?bad-domain\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^https?://(www\.)?bad-domain2\.net [NC]
RewriteRule \.(jpe?g|png|gif|webp|avif)$ /archives/wp-content/uploads/hotlink.jpe [NC,L]Replace the domains with the scrapers you’ve found, and adjust the banner path to your site. Our original 2012 rule only matched http:// referrers and older image types; this version also catches https:// sites and modern WebP and AVIF images.
To block all outside sites instead, allow blank referrers and your own domain, then block everything else:
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteCond %{HTTP_REFERER} !(google|bing|duckduckgo|facebook|x|linkedin)\. [NC]
RewriteRule \.(jpe?g|png|gif|webp|avif)$ - [F,NC,L]Always back up .htaccess first; a mistake can stop images or the whole site from loading. If you use a CDN for images, add the rule in the CDN instead, because requests may never reach your server.
Show a hotlink banner instead of a broken image
In the first rule, scrapers see hotlink.jpe instead of your picture. The unusual .jpe extension stops the rule from blocking its own banner. Tips for a good banner:
- Bright colour so readers notice the image was taken without permission.
- Tiny file size, because it’s served every time the scraper’s page loads.
- A short message with your domain, so curious readers find the original site.
- Readable at any size, since it stretches to the dimensions of the replaced image.
How to find sites hotlinking your images
- Search Google for the exact title of a new post in quotes to find copies.
- Check your hosting or CDN analytics for top referrers to image files.
- Use Google Lens or Images on one of your pictures to find pages showing it.
If a scraper uploads your images to its own server, hotlink protection won’t help; that’s copyright infringement, and you can file a DMCA notice. See our full guide to stop RSS feed scraping and content theft, and how to get free backlinks when scrapers republish your posts.
Frequently asked questions
Does stopping image hotlinking hurt SEO?
Not if you allow search engines and blank referrers. Blocking Google’s crawlers would remove your images from Google Images.
Why is hotlink protection not working?
The rule may be in the wrong folder, the CDN may be serving cached images, or the scraper now hosts copies of your images itself.
Will hotlink protection break my RSS feed images?
Blocking all outside referrers can. Blocking only specific scraper domains avoids that.
Can I stop hotlinking on Nginx?
Yes, with a valid_referers rule in the server block. Ask your host if you can’t edit the config.
Get our free weekly email: new tech guides and tools, no spam.
New and updated tech guides, a free tool worth bookmarking and one useful pick, once a week. No spam, unsubscribe anytime.
One email a week. Unsubscribe anytime. See our privacy policy.
This worked like a charm! No more free content for scrappers! Great using the .jpe extension for the image file to avoid loops btw. Thanks a bunch!
Hotlinking is a hassle for webmasters. It increases server load without any benefit or economical reward.
Very good stuff. Nicely explained.
A word of caution, to anyone who wants to edit their .htaccess file. Just make sure that you do not have any stray special characters or extra punctuation in it, or it could crash your website. If you do see errors like “Internal Server Error” or “Timeout” Errors, re-check the htaccess file. Chances are very high that something is wrong in it.
A very easy way to fix this would be to remove all the rules you have written. If you want to retain everything, yet want to be able to fix the issue without actually deleting the code, then simply use # symbol at the start of each line. # stands for comment, so it will comment out all the lines that you have used it in. So you can comment it & try again. That should fix it.
Hope this helps someone.
Awesome explanation on this topic. I like the way you presented it. It makes me think that I’m going to revive my blog site.
Nice piece. Thanks for writing it and the one on content protection.
Here are a few follow-on thoughts, and I apologize upfront if this sounds self promoting but hopefully our client’s strategy gives some helpful ideas to your readers.
One of our clients, who is very similar to @qot, started using our content protection network to detect and block hotlinking and web scraping sites in real-time. However, there was an unexpected benefit. In the detection process we identified and began blocking both illegitimate and multiple “legitimate” businesses who were hotlinking to our client’s content. Our client contacted these legitimate businesses and offered to sell them access to their content/data via an API. Essentially a whole new revenue stream was generated, that had not previously existed.
So regardless if you’re using Distil or some of methods above, the takeaway is to consider the additional revenue opportunities available to you.
it seems like a never ending battle with this stuff. Can’t we all just get along and stop trying to attack sites. This just makes life harder for everyone involved. it seems we spend 1 – 2 hours a day just applying security code and patches and blah blal blah to our site.