Description
Ensure Hotlink Protection is turned on, so that other websites cannot embed images hosted on your domain directly in their pages. Requests for your images from other sites are blocked unless they come from your own domain or an allowed exception.
Rationale
When other sites hotlink your images, they use your bandwidth and server resources without permission and may present your content as their own. Hotlink Protection blocks these requests, reducing bandwidth costs and unauthorized use of your content.
Impact
Other websites cannot embed your images
Reduces bandwidth theft
Partners who need to embed images must be exempted, for example using a hotlink-ok folder
Default Value
By default, Hotlink Protection is turned off.
Pre-Requisites
Cloudflare account with Administrator or Super Administrator role for the zone
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
Check the Hotlink Protection setting and verify that it is On.
If it is not On, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
Set Hotlink Protection to On.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Settings and (optionally) filter by Client-side abuse. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
Set Hotlink Protection back to its previous value.
Reference