CDN Hotlink Protection: Preventing Bandwidth Theft
What Is Hotlinking
Hotlinking occurs when another website embeds your content (images, videos, files) directly using your URLs. Their visitors consume your CDN bandwidth while their site gets the benefit of displaying your content. For foundational context, read CDN DDoS Protection: How CDNs Absorb Volumetric Attacks — FlyFish NWA.
<!-- On someone-else.com -->
<img src="https://your-cdn.com/photos/product.jpg">
<!-- You pay for every view on their site -->Impact
- Bandwidth costs — You pay for bandwidth consumed by another site's visitors
- Server load — Increased origin requests if hotlinked content isn't cached
- CDN bill shock — A viral hotlinked image on a high-traffic site can generate massive unexpected costs
Protection Methods
Referer Header Checking
The simplest method: check the HTTP Referer header and block requests from unauthorized domains.
| Metric | Edge Processing | Origin Processing | Improvement |
|---|---|---|---|
| Latency (p50) | 8–15 ms | 120–300 ms | 15–20x faster |
| Cache Hit Ratio | 85–95% | N/A | Reduces origin load |
| TLS Handshake | 1–5 ms (nearby PoP) | 50–150 ms | 10–30x faster |
| Bandwidth Cost | $0.01–0.04/GB | $0.05–0.12/GB | 3–5x cheaper |
| Availability | 99.99% (multi-PoP) | 99.9% (single DC) | 10x fewer outages |
# Nginx configuration
valid_referers none blocked server_names
*.yourdomain.com
yourdomain.com;
if ($invalid_referer) {
return 403;
}CDN configuration equivalent — allowlist your domains, block everything else.
Limitations: Referer can be spoofed. Some browsers and privacy tools strip the Referer header (requests without a Referer should be allowed, as they may be direct visits).
Signed URLs
Use signed URLs with short expiry times. Hotlinked URLs expire quickly, while your application generates fresh signed URLs for legitimate users.
CDN-Level Hotlink Protection
- Cloudflare — Hotlink Protection toggle (free). Blocks requests with non-matching Referer for images.
- CloudFront — Custom Referer header check via Lambda@Edge or CloudFront Functions.
- Akamai — Referrer-based access control in property configuration.
Granular Protection
Not all content needs hotlink protection. Apply it selectively:
| Content | Protect? | Reasoning |
|---|---|---|
| Product images | Yes | Expensive to serve, frequently hotlinked |
| CSS/JS assets | No | Small files, rarely hotlinked |
| Videos | Yes (signed URLs) | Very expensive to serve at scale |
| Logos/icons | Maybe | Small files, but may want to control usage |
| Downloadable files | Yes | Large files, direct cost per download |
Replacement Image Strategy
Instead of returning a 403 error, some sites serve a replacement image for hotlinked requests — a small image saying "Image hosted by [your-domain]" or a watermarked version. This deters hotlinking while potentially driving traffic to your site.
Allowlist Configuration
When configuring hotlink protection, allowlist:
- Your own domains (including subdomains, staging environments)
- Google's image cache and AMP domains
- Social media crawlers (for OG image previews)
- RSS feed readers (if you embed images in RSS)
- Requests with no Referer (direct visits, browser privacy modes)
Monitoring Hotlinking
Check your CDN analytics for: requests with unfamiliar Referer domains, unexplained bandwidth spikes on specific assets, popular files that shouldn't be popular. Use CDN monitoring to set up alerts for unusual referral patterns.