How to Enable Hotlink Protection in DirectAdmin

Hotlinking is when another website embeds your images or files directly by linking to your server — without hosting the files themselves. The result is that their visitors load your images but your server pays the bandwidth cost. Hotlink Protection stops this from happening. DirectAdmin includes a built-in hotlink protection tool that is easy to configure in just a few steps.

What Is Hotlink Protection?

When you publish an image on your website, the file is stored on your server. Normally, your own web pages load it — and that is fine. Hotlinking happens when someone on another website uses the direct URL of your image file in their own HTML <img> tag. Their page loads the image, but every time a visitor views their page, your server delivers the file and your bandwidth quota is consumed.

With hotlink protection enabled, your server checks where each file request is coming from (the HTTP Referer header). If the request does not originate from your own domain or a whitelisted source, the server blocks the file from loading — protecting your bandwidth and your content.

Why Hotlinks Waste Your Bandwidth

Bandwidth usage adds up quickly when your files are hotlinked by popular websites or social media posts. You may experience:

How to Enable Hotlink Protection in DirectAdmin

  1. Log in to your DirectAdmin control panel.
  2. Navigate to Advanced Features → Hotlink Protection.
  3. Toggle the feature to Enabled.
  4. In the URLs to allow hotlinks from field, add your own domain(s). At minimum, add:
    • https://www.yourdomain.com
    • https://yourdomain.com
  5. In the File Extensions to Protect field, enter the file types you want to protect (see the recommended list below).
  6. Optionally, set a Redirect URL — a URL to redirect blocked hotlink requests to (for example, a placeholder image or your homepage).
  7. Click Save to activate.

File Types to Protect

Enter the following extensions in the protected file types field to cover the most commonly hotlinked file formats:

You do not need to protect HTML, CSS, or JavaScript files — those are meant to be publicly accessible by browsers.

Whitelist Your Own CDN or Trusted URLs

If you use a CDN (Content Delivery Network) such as Cloudflare, BunnyCDN, or a third-party image service, you must add those URLs to the whitelist. Otherwise, the CDN's requests will be blocked and your images will not load for your own visitors.

To whitelist additional sources, add them to the URLs to allow hotlinks from field, one per line. For example:

Tip: If you notice that images stop loading on your own site after enabling hotlink protection, check that all your domain variants (with and without www, and both http and https) are added to the allowed URLs list. Missing one variant is the most common cause of self-blocking.

How to Disable Hotlink Protection

If hotlink protection causes issues — for example, breaking image embeds you intentionally allow, or interfering with a service that needs direct file access — you can turn it off at any time:

  1. Go to Advanced Features → Hotlink Protection in DirectAdmin.
  2. Toggle the setting to Disabled.
  3. Click Save.
Hotlink Protection page for preventing bandwidth theft
Hotlink Protection page for preventing bandwidth theft
Click Enable (circled) and enter allowed URLs then click Save
Click Enable (circled) and enter allowed URLs then click Save

The change takes effect immediately. You can re-enable it at any time with the same steps.

Understanding Bandwidth Theft and Its Real Costs

When someone hotlinks your files, the traffic looks harmless from the outside — but the financial and performance impact on your server can be significant. Every time a visitor loads the third-party page that embeds your image, your server receives and processes the HTTP request, reads the file from disk, and transmits it over the network. You pay the full cost of that delivery while receiving none of the traffic credit.

The real-world consequences include:

Hotlink protection eliminates all of these risks at the server level, before any file is transmitted.

Manual Hotlink Protection via .htaccess

DirectAdmin's graphical interface writes an Apache RewriteRule to your .htaccess file automatically. However, if you need more granular control — for example, to allow specific referrers, block particular file types selectively, or integrate the rule with other rewrite logic — you can write the rules manually.

Open public_html/.htaccess in File Manager and add the following block:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteRule \.(jpg|jpeg|png|gif|webp|pdf|mp4|mp3)$ - [F,L]

What each line does:

Replace yourdomain.com with your actual domain name. If your site has multiple domains, subdomains, or a CDN origin, add a separate RewriteCond line for each.

Whitelisting Specific Referrers

There are legitimate cases where you want third-party sites to load files from your server — such as Google Images showing your photos in search results, or a partner site displaying your logo. You can whitelist these on a per-domain basis.

Whitelisting Your Own Site (Required)

Always add all variants of your own domain to the allow list. Missing even one variant (such as the www version) will cause your own site to block its own images:

Whitelisting Google Images

When users click an image in Google Image Search, their browser loads the image directly from the origin server, and the Referer header contains a google.com domain. To keep your images visible in Google Images:

Whitelisting Facebook Preview Crawlers

Facebook's link preview crawler (facebookexternalhit) fetches the OG image when someone shares your URL. If it gets a 403, the preview will have no image. In most Apache configurations, crawlers that send empty Referer headers are already allowed through. If Facebook previews are broken after enabling protection, add https://www.facebook.com to the allow list.

Social Media Sharing and Open Graph Images

One area where hotlink protection can have an unintended effect is social media link previews — the rich cards that appear when someone shares your URL on Facebook, Twitter/X, LinkedIn, or WhatsApp. These previews rely on crawlers fetching the image specified in your page's Open Graph tags.

How Social Media Crawlers Work

When a user shares your URL, the platform's crawler visits your page and reads the og:image meta tag. It then fetches that image URL to generate the preview thumbnail. If hotlink protection returns a 403 for that request, the preview is generated without an image — appearing as plain text, which significantly reduces click-through rates.

Why Most Setups Work Fine

Social media crawlers typically send requests with an empty Referer header. Standard hotlink protection rules include a condition that allows requests with no Referer (RewriteCond %{HTTP_REFERER} !^$), so crawlers pass through automatically. The issue only arises if your rules are overly strict — for example, if you block all requests except those from your own domain, including those with empty Referers.

Testing and Fixing Preview Issues

If your social previews stop working after enabling hotlink protection:

Summary

Protect Your Website Assets

AsiaGB hosting includes DirectAdmin with hotlink protection, SSL, and robust bandwidth allocation — built for Thai websites of all sizes.

View Hosting Plans