--- title: "Stop other sites from serving your files ยท Agent Wranglers" url: https://agentwranglers.se/playbook/files-and-media/serving-files/hotlink-protection id: MED-30 level: Recommended updated: 2026-10-22 build: a2a6bdfed830 tokens: 675 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Stop other sites from serving your files For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Serving files](https://agentwranglers.se/playbook/files-and-media/serving-files.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. - ID: MED-30 - Level: Recommended - Chapter: [Serving files](https://agentwranglers.se/playbook/files-and-media/serving-files.md) - Rule: Serve private files only through addresses that expire. For public files, refuse requests at the CDN whose `Referer` names a site outside your own list, and allow requests that send no `Referer`. - Check: Request a public image with `Referer: https://other.example.net/`, and the CDN answers 403. The same request with your own domain, or with no `Referer`, answers 200. - How: Another site that embeds your images or videos sends its visitors' traffic to your bill. Expiring addresses stop that for private files, as [Serve private files through short-lived links](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-downloads.md) says. For public files, most CDNs can check the `Referer` header against a list of your domains. Many browsers and privacy tools send no `Referer` at all, so a missing header must pass, or your own visitors see broken images. Leave the files you want shared, such as press images, off the check. The spend that hotlinking causes shows up in [Watch data sent out per file and per owner](https://agentwranglers.se/playbook/files-and-media/quotas-and-cost/egress-alerts.md). ## Sources - [RFC 9110 (HTTP Semantics, section 10.1.3 Referer)](https://www.rfc-editor.org/rfc/rfc9110#section-10.1.3) ## Related rules - MED-46 [Serve private files through short-lived links](https://agentwranglers.se/playbook/files-and-media/serving-files/signed-downloads.md) in Files and media - MED-29 [Watch data sent out per file and per owner](https://agentwranglers.se/playbook/files-and-media/quotas-and-cost/egress-alerts.md) in Files and media **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers files and media playbook`. In code you write, add a comment next to it with the same link. - Previous: [Give every share link a random token and an expiry](https://agentwranglers.se/playbook/files-and-media/serving-files/share-links.md) - [Serving files](https://agentwranglers.se/playbook/files-and-media/serving-files.md)