How to Enable Hotlink Protection in cPanel

Hotlinking (also called inline linking, or bandwidth theft) happens when another website embeds one of your images directly from your hosting account instead of uploading its own copy. Every time a visitor loads that external page, the file is served from your account and consumes your bandwidth, while the other site takes the credit. cPanel's Hotlink Protection blocks requests for your files unless they come from pages you have approved. This guide shows you how to enable it on your Noiz hosting account, how to configure it so it does not break your own site, and how to prove it is actually working.

Last reviewed: 27 July 2026, against the current stable release of cPanel & WHM and its Jupiter interface. This guide is written for Noiz hosting and is kept current against cPanel. It complements, and does not replace, the official cPanel documentation linked below.

Official Documentation Reference

• cPanel Docs: Hotlink Protection
• Apache HTTP Server: mod_rewrite reference
• MDN: the HTTP Referer header

Prerequisites

• Your cPanel sign-in details, which are in your Noiz hosting welcome email or available from your Noiz client area.
• A list of every domain and subdomain that legitimately displays your files: your main site, both the www and non-www addresses, any staging or demo subdomain, and any other site of yours that embeds the same images.
• If your site runs a CMS such as WordPress, know where its .htaccess file lives, because Hotlink Protection writes its rules into that same file.

How Hotlink Protection Actually Works

Understanding the mechanism saves a lot of guesswork later. When a browser loads a page and then fetches an image embedded in it, the browser normally sends a Referer header naming the page the request came from. cPanel writes a set of Apache rewrite rules into the .htaccess file in your document root, and those rules inspect that header. If the referring page is on one of your approved domains, the file is served. If it is on anything else, the request is blocked or redirected. You never need to edit .htaccess by hand; the settings page manages the rules for you.

Two consequences follow, and between them they explain nearly every problem people hit with this feature:

• The decision rests on a header the visitor's browser supplies, not on anything cryptographic. Privacy extensions, some mobile apps, corporate proxies and strict browser settings strip the Referer header entirely, so those requests arrive looking as though nobody sent them. The header can also be forged. Treat Hotlink Protection as a strong deterrent against casual bandwidth theft, not as watertight security.
• Apache applies the rule at the moment the file is requested, so the feature stops embedding, not copying. Anyone can still right-click, save the image, and upload it to their own server. For that you need copyright notices, watermarking and takedown requests rather than a technical block.

Enable Hotlink Protection

1. Log in to your cPanel account.
2. In the Security section, click Hotlink Protection.
   
3. If the page shows Hotlink protection is currently disabled, click Enable. The status line at the top of the page changes to confirm it is on.
   

Enabling it applies the default settings straight away, so work through the options below before you move on.

Configure the Settings That Matter

URLs to Allow Access

cPanel pre-fills this box with the addresses it detects for your account, but the list is rarely complete, and a missing entry means your own pages start showing broken images. Enter one URL per line and include:

• Both the bare and the www form of each domain, for example https://yourdomain.com and https://www.yourdomain.com.
• Every subdomain that embeds your files, such as a demo site at https://demo.yourdomain.com.
• Any separate site of yours, or any content delivery network, that legitimately loads the same files.
• The http:// forms as well, if you still serve anything without TLS.

Replace yourdomain.com with your own domain. Anything not on this list is blocked.

Block Direct Access for the Following Extensions

This comma-separated list decides which file types are protected. The cPanel default is a short list of older image formats, typically jpg,jpeg,gif,png,bmp. That default is now the most common reason people conclude Hotlink Protection is broken: modern sites and CMS image plugins serve webp and avif, and neither is in the default list. Add the formats you actually use, for example:

jpg,jpeg,gif,png,bmp,webp,avif,svg

If the files being leeched are large media rather than images, add those extensions too, such as mp4, mp3, zip or pdf. Do not add html, css or js: blocking stylesheets and scripts breaks legitimate integrations and caching services and gains you almost nothing.

Allow Direct Requests

A direct request is one that arrives with no referring page at all. Tick this box and those requests are served; untick it and they are blocked as well.

Leave it ticked unless you have a specific reason not to. Requests with no referrer come from people typing an image address straight into the browser, opening an image from a bookmark, email clients displaying images, the link-preview scrapers used by social and messaging platforms, and any visitor whose browser or privacy tool suppresses the header. Unticking this box is the quickest way to break your own site for a slice of entirely ordinary visitors.

Redirect the Request to the Following URL

Optionally, blocked requests can be sent somewhere else rather than simply failing. Many site owners point this at a branded placeholder image, which turns an attempted hotlink into free advertising. Leave it empty to deny the request outright.

One trap to avoid: do not point the redirect at a file that is itself on a protected domain and carries a protected extension. The replacement image is then blocked in turn and the request loops. Host the replacement elsewhere, give it an extension you have not listed for blocking, or redirect to an ordinary web page instead.

When the fields are set, click Submit to save.

Confirm It Is Working

Do not test by loading your own site, because your own pages are on the allowed list and will look normal either way. Test by pretending to be somebody else. From a terminal, run these two commands, replacing the example domain and image path with your own:

curl -s -o /dev/null -w "%{http_code}\n" -e "https://example-thief.com/" https://yourdomain.com/images/logo.jpg
curl -s -o /dev/null -w "%{http_code}\n" -e "https://yourdomain.com/" https://yourdomain.com/images/logo.jpg

The first request pretends to come from someone else's site and should return 403, or 301 or 302 if you configured a redirect. The second pretends to come from your own site and should return 200. If both return 200, that file's extension is almost certainly missing from your blocked list.

Limitations Worth Knowing

• It only protects files served from your account. Files delivered through a content delivery network, an object storage bucket, or a separate media host are outside these rules and need protection configured at that service instead.
• Coverage follows the document root. The rules are written into the .htaccess file in your main document root and are inherited by the folders beneath it. A subdomain or add-on domain whose document root sits outside that folder is not covered.
• Image search and social previews. Search engines index images by fetching them, and social and messaging platforms fetch them to build link preview cards. Most of those fetches carry no referrer, so leaving Allow direct requests ticked is what keeps them working. Untick it and you may lose image search visibility and preview thumbnails along with the hotlinkers.
• Legitimate third parties need listing. If a page builder, a newsletter platform or a partner site loads your images from its own domain, add that domain to the allowed list or its images break too.

Troubleshooting

Images on your own site are now broken: a hostname is missing from URLs to allow access. Check the exact address in your browser's URL bar, including whether it carries www, and add that exact form. Clear your browser cache and any caching plugin before retesting.

Hotlinking still works: the file extension is not in your blocked list. On a modern site this is nearly always webp or avif. Add it and retest with the curl commands above.

Images vanish from social previews or image search: tick Allow direct requests, since most of those fetches send no referrer, and set a redirect URL to a branded placeholder if you would rather those services receive an image than a block.

Some visitors see broken images and others do not: the Referer header is being stripped by a privacy tool, proxy or app on their side. Tick Allow direct requests.

The settings reverted on their own: cPanel stores these rules in .htaccess, and some CMS, security and migration plugins rewrite that file wholesale. Find the plugin that regenerates .htaccess, then re-save your Hotlink Protection settings afterwards.

Requests loop or time out: your redirect target is itself being blocked. Point it at a file on another domain, or at a normal web page.

There is no Hotlink Protection icon in cPanel: the feature may be disabled at server level for your plan. Contact Noiz support and the team will confirm what is available on your hosting.

Need a Hand?

Hotlink Protection is a blunt instrument, and striking the balance between blocking bandwidth theft and keeping your own site working takes a little tuning. If images break after you enable it, or you are unsure which domains to allow or which extensions to block, open a support ticket from your Noiz client area. If your hosting plan uses a different control panel, the support team will point you at the equivalent setting there and confirm the result for you.