![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Concepts
- Traffic detections
- Overview
- Attack score
- Malicious uploads
- Bot score
- Threat intelligence
- Custom rules
- Overview
- Create in the dashboard
- Create via API
- Create using Terraform
- Configure a rule with the Skip action
- Common use cases
- Allow traffic from IP addresses in allowlist only
- Allow traffic from search engine bots
- Allow traffic from specific countries only
- Block Microsoft Exchange Autodiscover requests
- Block requests by attack score
- Block traffic by geographical location
- Block traffic from specific countries
- Build a sequence rule within custom rules
- Challenge bad bots
- Configure token authentication
- Exempt partners from Hotlink Protection
- Issue challenge for admin user in JWT claim based on attack score
- Require a specific cookie
- Require known IP addresses in site admin area
- Require specific HTTP headers
- Require specific HTTP ports
- Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
- Update custom rules for customers or partners
- Custom rulesets
- Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform
- Troubleshooting
- Create exceptions
- Log the payload of matched rules
- Additional tools
- Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Analytics
- Security features interoperability
- Reference
- Alerts
- Phases
- Legacy features
- WAF managed rules (previous version)
- Rate Limiting (previous version)
- Firewall rules
- Firewall rules upgrade
- Glossary
- Home
- /WAF
- /…Additional tools
- /Scrape Shield
- /Hotlink Protection
Hotlink Protection
Hotlink Protection prevents your images from being used by other sites, which can reduce the bandwidth consumed by your origin server .
The supported file extensions are gif, ico, jpg, jpeg, and png.
When Cloudflare receives an image request for your site, we check to ensure the request did not originate from visitors on another site. Visitors to your domain will still be able to download and view images.
Technically, this means that Hotlink Protection denies access to requests when the HTTP referer does not include your website domain name (and is not blank).
Hotlink protection has no impact on crawling, but it will prevent the images from being displayed on sites such as Google images, Pinterest, and Facebook.
To enable Hotlink Protection in the dashboard:
-
In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗ -
(Optional) Filter by Client-side abuse.
-
For Hotlink Protection, switch the toggle to On.
To enable Hotlink Protection with the API, send a PATCH request with hotlink_protection as the setting name in the URI path, and the value parameter set to "on".
Note
To use this feature on specific hostnames - instead of across your entire zone - use a configuration rule.
If you are a SaaS provider using Cloudflare for SaaS, note that, by default, Hotlink Protection will only allow requests with your zone as referer. To avoid blocking requests from your customers (custom hostnames), consider using Configuration Rules or custom rules.
You may want certain images to be hotlinked to, whether by external websites (like Google) or certain situations like when using an RSS feed.
To disable Hotlink Protection selectively, create a configuration rule covering the path of an image folder.
You can allow certain images to be hotlinked by placing them in a directory named hotlink-ok. The hotlink-ok directory can be placed anywhere on your website.
To allow another website to use logo.png from example.com, put logo.png in a new folder called hotlink-ok.
Some examples of URLs that will not be checked for hotlinking:
http://example.com/hotlink-ok/pic.jpghttp://example.com/images/hotlink-ok/pic.jpghttp://example.com/hotlink-ok/images/pic.jpghttp://example.com/images/main-site/hotlink-ok/pic.jpg
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}