On this page
Hotlink protection stops other sites from embedding your images and media by checking the Referer header. When you turn it on in cPanel, you must allow every hostname that legitimately serves your pages, or you will 403 your own assets. Used carefully, it cuts real bandwidth waste without breaking the site you meant to protect.
What hotlink protection actually does
cPanel’s hotlink tool looks at the Referer the browser sends with each request. If that Referer is not on your allow list, the server returns 403 for the file types you chose. It is a simple check, not a billing system and not free bandwidth money. Blank Referers are common in mail clients and privacy-minded browsers, so you usually want those allowed unless you accept broken in-mail images.
List every HTTPS hostname that serves HTML for your site: the apex domain, www, staging if images should still load there, and any CDN hostname. Leave old http-only leftovers off the list. Shared hosting here runs cPanel with LiteSpeed, so a cached 403 on a logo path can look like a broken theme until you purge the cache.
When to turn it on
Turn it on when logs show another site embedding large files and the traffic actually matters. Leave it off when you are not leaking meaningful bandwidth. Put every real hostname on the allow list before you save, including the CDN if you use one.
Leech protection in cPanel (password after N downloads) is a blunt older tool. If you sell downloads, prefer signed URLs in the application. A Referer check will not invoice a customer and can 403 a paying user on a browser that strips Referer.
When it is the wrong tool
Hotlink protection plus a CDN with a missing allow-list entry often 403s images in other regions or for empty Referers. Forgetting www or a custom shop domain does the same. Allow blank Referers unless you are willing to break mail clients and a slice of privacy browsers.
Default stays off until logs show a real leech. If you enable it, allow your own names, CDN names, and blank Referers, then test. Password hygiene and signed URLs still matter more than who embeds a small logo.
How to test before you walk away
Confirm behavior with curl so you know 200 and 403 mean what you intended. You want success with your own Referer and usually with no Referer, and a block from a random foreign host if that was the goal.
curl -I https://www.example.com/uploads/logo.png
curl -I -H “Referer: https://www.example.com/” https://www.example.com/uploads/logo.png
curl -I -H “Referer: https://random-forum.example/” https://www.example.com/uploads/logo.pngIf the request with no Referer returns 403, allow blank Referers. If your own www host returns 403, add www to the allow list. Then purge LiteSpeed cache for that path, because a cached 403 on /uploads/logo.png can look like a broken theme for a while.
Tagged
Was this article helpful?
Be the first to rate this article.
