Agent WranglersMED-30Recommended
Stop other sites from serving your files
Serve private files only through addresses that expire. For public files, refuse requests at the CDN whose Referer names a site outside your own list, and allow requests that send no Referer.
How to do it
Another site that embeds your images or videos sends its visitors' traffic to your bill. Expiring addresses stop that for private files, as Serve private files through short-lived links says. For public files, most CDNs can check the Referer header against a list of your domains. Many browsers and privacy tools send no Referer at all, so a missing header must pass, or your own visitors see broken images. Leave the files you want shared, such as press images, off the check. The spend that hotlinking causes shows up in Watch data sent out per file and per owner.
How to check
Request a public image with Referer: https://other.example.net/, and the CDN answers 403. The same request with your own domain, or with no Referer, answers 200.
Sources
Related rules
- MED-46 Serve private files through short-lived links in Files and media
- MED-29 Watch data sent out per file and per owner in Files and media
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/files-and-media/serving-files/hotlink-protection">Agent Wranglers files and media playbook</a>. In code you write, add a comment next to it with the same link.