Hotlink protection stops other sites from directly embedding your images or files in a way that uses your server’s bandwidth to serve their content, and leech protection restricts how content can be accessed or downloaded in bulk — both configured through your control panel’s available security settings.
Hotlink protection & leech protection setup
Hotlink and leech protection configured, without blocking legitimate embedding you actually want.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Access to your hosting control panel’s security settings
- Confirmation of which file types need protecting (images, downloads, or both)
- Confirmation of any legitimate external sites that should be allowed to embed your content, so they’re not accidentally blocked
This or something else?
| You want to prevent other sites from hotlinking your images or files, or restrict bulk content access | This fix covers it |
| You want IP-based blocking or country restrictions instead, a different kind of access control | IP blocking & country restriction at host |
| You’re seeing an unusually high bandwidth usage and suspect hotlinking as the cause | This fix directly addresses that suspected cause |
| Your host’s control panel doesn’t offer this specific feature | Worth confirming your specific hosting setup — an alternative approach (like a .htaccess rule, where feasible) might be worth discussing |
What we do
- Confirm which file types need protection and any legitimate exceptions
- Configure hotlink protection through your control panel’s available settings
- Configure leech or bulk-access protection where relevant and available
- Verify legitimate access (your own site, allowed exceptions) still works correctly
- Test that hotlinking from an unauthorized external source is genuinely blocked
- Document the configuration for future reference
What is included
- Hotlink protection configured for your specified file types
- Leech protection configured where relevant and available
- Verified legitimate access continues working correctly
- Tested confirmation unauthorized hotlinking is blocked
Not included
- IP-based blocking or country restrictions, a separate, related fix
- Recovering bandwidth or resources already consumed by past hotlinking
- Configuring this where your specific host’s control panel doesn’t offer the feature at all
- Ongoing monitoring for new instances of hotlinking
Questions about this fix
How would I know if hotlinking is actually happening to my site?
Unusually high bandwidth usage relative to your own traffic, or images appearing on other sites that clearly link directly to your server rather than hosting their own copy, are both common signs worth checking for.
Will this block legitimate uses, like someone sharing a link to my image on social media?
No, hotlink protection specifically targets a page on another site directly embedding your image file as if it were their own — clicking through to view your image or sharing a link to your page isn't affected.
What if I want certain partner sites to be able to embed my content?
We'd configure an exception for any legitimate site you specify, so protection applies broadly while still allowing intentional, approved embedding.
Does this protect my content from being downloaded and reused elsewhere entirely?
Not entirely — hotlink protection specifically stops direct embedding that consumes your bandwidth; it doesn't prevent someone from downloading and re-uploading your content to their own server, which is a different, broader concern.
Could this accidentally break something on my own site?
We test to confirm your own site's legitimate use continues working correctly, since overly aggressive protection could otherwise interfere with your own images or files loading properly.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.