# Best practice to prevent image hotlinking?

**URL:** <https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814>\
**Category:** Support\
**Created:** [2월 17, 2018, 11:51오전 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814 "2018-02-17T11:51:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ljpp](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ljpp/32/96506_2.png) [@ljpp](https://meta.discourse.org/u/ljpp)\
**Post date:** [2월 17, 2018, 11:51오전 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814/1 "2018-02-17T11:51:19Z")

</div>

I have images uploaded to S3 and CloudFlare enabled on my site. To my knowledge however, and correct me if I am wrong, the CloudFlare’s hotlink protection does not work due to the images being hosted on a different domain.

Any suggestions or example implementations? If the S3 bucket policy is the way to go, I would love to see a .json code example.

---

<div class="post-metadata">

**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\
**Post date:** [2월 18, 2018, 9:04오후 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814/2 "2018-02-18T21:04:09Z")

</div>

You’d want to talk to CloudFlare about that, presumably. There’s nothing Discourse-specific about hotlinking protection on S3.

---

<div class="post-metadata">

**Author:** ![ljpp](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ljpp/32/96506_2.png) [@ljpp](https://meta.discourse.org/u/ljpp)\
**Post date:** [2월 18, 2018, 9:29오후 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814/3 "2018-02-18T21:29:49Z")

</div>

No, nothing Discourse specific. But many of us rely on S3, so I am interested in how people treat hotlinking — new stuff for me personally, so gotta learn. Useful for anyone using S3, as hotlinking will become an issue. It just a matter of time.

---

<div class="post-metadata">

**Author:** ![rdyar](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rdyar/32/82986_2.png) [@rdyar](https://meta.discourse.org/u/rdyar)\
**Post date:** [2월 18, 2018, 9:30오후 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814/4 "2018-02-18T21:30:53Z")

</div>

no idea how this works with CloudFlare, but an S3 bucket policy to do this checks the referer.

The code below has nothing to do with discourse, it is protecting some files in a special paid section of an old website I have.

```plaintext
{"Version":"2008-10-17",
"Id":"preventHotLinking",
"Statement":[
{"Sid":"1","Effect":"Allow","Principal":
{"AWS":"*"},"Action":"s3:GetObject",
"Resource":"arn:aws:s3:::downloads.ephotopros.com/*",
"Condition":{"StringLike":{"aws:Referer":
["http://dev.ephotopros.com/*","http://ephotopros.com.s3.amazonaws.com/*",
"http://ephotopros.com/*","http://s3.amazonaws.com/ephotopros.com/*",
"http://localhost:4000/*","http://prolabprints.com/*"]}}}]}

```

The files are served from the main domain, the downloads sub domain is just the bucket name on S3. So the referrer check needs to match where the files should be allowed to be served from.

Interesting that it looks like Referer is mis-spelled but that is working code.

---

<div class="post-metadata">

**Author:** ![notriddle](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/notriddle/32/133055_2.png) [@notriddle](https://meta.discourse.org/u/notriddle)\
**Post date:** [2월 19, 2018, 1:43오전 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814/5 "2018-02-19T01:43:24Z")

</div>

> [@rdyar](#):
>
> Interesting that it looks like Referer is mis-spelled but that is working code.

> **[HTTP referer | Etymology](https://en.wikipedia.org/wiki/HTTP_referer#Etymology)**
>
> The misspelling of referrer was introduced in the original proposal by computer scientist Phillip Hallam-Baker to incorporate the "Referer" header field into the HTTP specification. The misspelling was set in stone by the time (May 1996) of its incorporation into the Request for Comments standards document RFC 1945 (which "reflects common usage of the protocol referred to as 'HTTP/1.0'" at that time); document co-author Roy Fielding remarked in March 1995 that "neither one (referer or re When vis...

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\
**Post date:** [6월 2, 2020, 1:43오전 UTC](https://meta.discourse.org/t/best-practice-to-prevent-image-hotlinking/80814/6 "2020-06-02T01:43:11Z")

</div>