What Is Image Hotlinking and Why You Should Avoid It

Hotlinking (also called inline linking or direct linking) is the practice of embedding an image on your website using its URL from someone else's server. Your page loads, the browser makes a request to the other website's server to download the image, and displays it on your page — without you hosting the file yourself.

Why hotlinking is a problem

It steals bandwidth. Every time someone visits your page and the image loads, the bandwidth cost is paid by the website you're hotlinking from — not you. For popular websites with large images, this can amount to significant costs. Server bandwidth isn't free.

It's unreliable. The other website can change the image filename, move it, or delete it at any time. When they do, your image breaks — replaced by a missing image icon or a placeholder. You have no control over whether the image continues to work.

They can replace the image. Website owners who detect hotlinking can replace the hotlinked file with a different image — anything from a "please don't hotlink" message to something embarrassing. This has caught many hotlinkers off guard in memorable ways.

It can get you penalized. Some hosting providers prohibit hotlinking in their terms of service. Using another site's resources without permission may also constitute a terms of service violation on the source site.

SEO and performance. Hotlinked images are served from an external domain, introducing a DNS lookup and connection overhead for each hotlinked image. This slows page loading.

How to detect hotlinking on your own images

If you run a website and want to check whether your images are being hotlinked:

• •Check your server access logs for requests to image files with a Referer header pointing to an external domain.
• •Use Google Search Console's coverage reports to find image URLs receiving unexpected traffic.
• •Some hosting control panels (cPanel) have built-in hotlink protection tools.

How to prevent others from hotlinking your images

Via .htaccess (Apache, LiteSpeed, most shared hosting): Add these lines to the .htaccess file in your site's root folder, replacing example.com with your own domain:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com [NC]
RewriteRule \.(jpe?g|png|gif|webp|svg)$ - [F,NC,L]

The first condition allows requests with no referrer (people opening the image directly, some privacy-focused browsers). The second allows your own pages. Everything else is refused.

This returns a 403 Forbidden response for image requests that come from other domains. Direct browser access and requests from your own domain work normally.

Via Cloudflare: The Hotlink Protection feature under Scrape Shield blocks third-party sites from embedding your images. Easy to enable with one click.

What to do instead of hotlinking

Download and host the image yourself. If you have the right to use the image (through a license or Creative Commons permission), download it and upload it to your own hosting. You control the URL, the uptime, and the file.

Use a CDN for your own images. Services like Cloudflare, BunnyCDN, or AWS CloudFront host your images efficiently and serve them from edge locations close to your visitors.

Use stock photo services properly. If you're sourcing images from Unsplash, Pexels, or Pixabay, download and host the file rather than embedding from their CDN. The free license permits this, and it's more reliable.

For social media embeds: Platforms like Twitter, Instagram, and YouTube provide official embed codes that load assets from their own infrastructure — these are not hotlinking and are explicitly permitted.

The simple rule: if the image isn't on your server or a CDN you control, don't embed it directly on your website.