This guide explains how to limit hotlinking on files hosted by your Infomaniak Web Hosting.

Introduction

• Hotlinking is when a third-party website displays images, videos, or other files hosted on your server directly, using their public URL, without hosting them itself.
• This practice uses your hosting's resources (bandwidth, HTTP connections, and server resources) without your authorization. It can also infringe on your copyrights or your control over the distribution of your content.
• Although current network capabilities make the impact on bandwidth generally less critical than before, it is still recommended to limit hotlinking to avoid unnecessary consumption of your hosting resources.

Prevent hotlinking with an .htaccess file

If your website uses the Apache web server and the mod_rewrite module, you can restrict direct access to certain files by adding rules to the .htaccess file located in the root directory of your website.

The example below protects the main image formats, including the modern WebP and AVIF formats:

RewriteEngine On

# Allow requests without a Referer header
RewriteCond %{HTTP_REFERER} !^$

# Allow requests from your own domain (replace with your domain)
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?votre-domaine\.com [NC]

# Allow major search engines
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?google\. [NC]
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?bing\. [NC]
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yahoo\. [NC]

# Block hotlinking for image files
RewriteRule \.(jpg|jpeg|png|gif|svg|webp|avif)$ - [F,NC,L]

Adapt before use:

• Replace your-domain.com with your own domain name.
• Requests that do not contain an HTTP Referer header are allowed in order to maintain compatibility with certain browsers, applications, or privacy protection mechanisms that do not transmit this header.
• The rules allowing major search engines to access images enable their robots to index them. Deleting them will prevent these images from being indexed.
• The rule uses the [F] option, which returns an HTTP 403 Forbidden response. This method immediately blocks the request without serving any additional content, which limits the consumption of server resources.