Blocking Hotlinking of Images by Other Websites

Posted by Hans de Ruiter

There have been several cases of external websites embedding images from this website directly into their pages. Known as hotlinking, this results in bandwidth being used up on this website, for the traffic belonging to another website. Hotlinking is essentially stealing of bandwidth from another website, which someone else (or me, in the case of this website) has to pay for. Up until now I have been fairly relaxed about this, after all, some of these external pages were discussing projects on this website and providing inbound links. However, I have also had totally non-related websites hotlinking websites. Most recently, a classified listing on another website was using a photo of my old Compaq Presario in order to sell their item. Not only is this non-related traffic, but the photo shown in the advertisement was most certainly not of the item being sold; something that could be misleading to prospective buyers (it's clearly not a company promotional shot, so the assumption would be that it is the second hand item being sold). With this latest incident I decided that I was fed up with others stealing my bandwidth for non-related websites, and any page that hotlinks to this website now shows the following image:

How to Block Hotlinking

There are various methods with which hotlinking can be blocked, but the method that I used was to add this to the end of the .htaccess file for this website (below the Silverstripe URL rewriting):

# Block image hotlinking
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?hdrlab.org.nz [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ /images/nohotlinking.png [L]

This works by examining which webpage the file request was linked from (i.e., the referer), and redirecting any image request for which the referer is not this website (or unknown) to the image shown above. Note that "RewriteEngine On" must appear in the .htaccess before the code above, or it will do nothing. Anyone using this code should replace "hdrlab.org.nz" with their own website's URL.

What's Wrong with Hotlinking?

Some people would argue that there is nothing wrong with hotlinking. Their claim is that, since the website owner has made it publicly available, people should be able to do what they wish with it. This is not the case. What appears on one website can be copyrighted content that may not be used on another website without permission. However, this is not the real issue, the real issue is who pays for the bandwidth resulting from website traffic.

Let us say that I owned a website with millions of visitors per month, and I hotlinked an image from your small website with a 1 GiB/month allowance and placed it on the home-page. All of a sudden your website would receive millions of downloads of that image, which, not being a small file, this promptly exceeds your bandwidth limit, which either takes your website offline, or gives you a hefty bill for extra bandwidth charges. Clearly this is unfair; you should not have to pay for the bandwidth of visitors to my website, or any other website for that matter.

This is why websites should either obtain permission to host the image themselves (which they should be doing anyway, regardless), or posting a link to the website containing the image so that it can be viewed within the original website. In a previous argument about this topic, someone pointed out that an external website posting a link to my website would result in even more of my site's bandwidth being used up than if they just hotlinked the image. True, however this bandwidth would be due to people visiting my website, as opposed to visitors of the other website. I would be quite happy to pay for extra bandwidth if this website had a huge influx of visitors; hopefully the advertisements shown to these visitors would cover the extra costs, or at least offset them. What I am not okay with is paying for another website's traffic.

Watermarking Images - An Alternative to Blocking

If bandwidth is not an issue for you, but you object to the lack of acknowledgement when someone hotlinks an image, another option could be to insert a watermark into hotlinked images. That way, your logo and URL could appear in the image itself whenever it is hotlinked. I personally opted for blocking and placing this website's logo and URL into the redirected image; I do want to discourage hotlinking.

Comments (9) | 28 July 2009