Hotlinking is when a third-party website displays your image, video or downloadable file by pointing its page directly at your URL. Every visitor's browser then fetches the asset from your origin or CDN, and you pay for the egress. The billing answer to what is hotlinking is simple: bandwidth theft. Their page view, your bytes, your invoice.
A 3 MB image hotlinked from a page with 500,000 monthly views moves 1.5 TB of egress out of the image owner's account. At 2026 CDN list rates of roughly $5 to $85 per TB, that costs about $7.50 to $128 a month. Hotlink protection at the CDN edge, through HTTP Referer checks or signed URLs, rejects those requests before the asset bytes are delivered.
A hotlink is an ordinary cross-site subresource request. A page on another domain contains an image element, a video source or a download link whose URL resolves to your hostname. The visitor's browser opens a connection to your edge and sends a GET request. Your CDN treats it like any other request: it serves the object from cache, or pulls it from origin first, and counts the bytes against your bill.
Three request headers reveal where the request came from:
Video makes the problem worse. A hotlinked HLS or DASH player loads your manifest and then every segment. One 10-minute 1080p clip at 5 Mb/s is about 375 MB, so 20,000 plays from a forum thread add up to 7.5 TB of egress, roughly $37.50 to $640 at the same rate range.
Hotlink protection belongs at the edge, in the request-evaluation phase, before cache lookup or right after it. Enforcing it at origin protects nothing on a CDN. A cached object served to a hotlinker never reaches origin, so the origin's referer rule never runs, while the edge still bills the transfer.
Rule order matters. Evaluate cheap header checks first, then token validation, and only after that the cache key computation. If a token query parameter ends up in the cache key, every signed URL becomes a unique object. Your cache hit ratio drops toward zero and the origin absorbs the load.
Hotlinking vs. embedding: embedding uses a player or widget that the content owner provides on purpose, such as a share code, and the owner usually accepts or monetizes the bandwidth. Hotlinking reuses your raw asset URL without consent. On the wire the traffic looks identical, so the difference lies in intent and authorization, and that is why the defense has to be an allowlist or a token.
Hotlinking vs. scraping or mirroring: a scraper downloads your file once and serves it from its own servers. That is a copyright problem, not a bandwidth problem. Hotlinking keeps the file on your infrastructure, so the cost recurs on every page view.
Hotlinking vs. CORS: Cross-Origin Resource Sharing governs whether page code can read a cross-origin response. It does not stop a browser from displaying a cross-origin image or playing a cross-origin video. Adding CORS headers neither causes hotlinking nor prevents it.
Allow requests whose Referer host matches your own domains, for example example.com and any subdomain of it, plus the domains of partners you approve. Return 403 for any other referer. The key decision is what to do with an empty Referer. Privacy extensions, no-referrer policies, native apps and direct navigation all send none. Blocking them breaks real users, and allowing them leaves a gap. Most production rules allow an empty referer.
A signed URL adds an expiry timestamp and a token to the request. The token is an HMAC-SHA256 over a shared secret, the path and the expiry, optionally bound to the client IP. Your application issues it, and the edge recomputes it without calling origin. A leaked link works only until it expires.
For HLS, sign a path prefix instead of each file. One token then covers the manifest and every segment under that directory. Keep the expiry window longer than the content duration plus a buffer for clock skew, and strip the token from the cache key.
An edge rule that returns 403 when Sec-Fetch-Site is cross-site and Sec-Fetch-Dest is image or video blocks browser hotlinks that a forged Referer would slip past. Sending Cross-Origin-Resource-Policy: same-site makes the browser refuse to render the response cross-site. That second header blocks display, not necessarily the transfer, so pair it with edge enforcement.
BlazingCDN includes referrer rules, signed URLs, tokens, geo and IP lists and rate limiting on every plan, so these controls run at the edge without extra add-ons. The BlazingCDN edge access-control features list them.
The higher the bytes per request and the lower the tolerance for leakage, the more the defense should move from header inspection toward cryptographic tokens.
"A referer check stops hotlinking." It stops casual browser hotlinking only. Any non-browser client can set the Referer to whatever value it wants.
"Blocking empty referers is the strict, safe setting." It produces 403 errors for privacy-conscious users, for app webviews and for anyone who pastes a URL into the address bar. Measure the share of your legitimate traffic that arrives without a referer before you block it.
"Signed URLs ruin cache efficiency." They do so only when the token lands in the cache key. With the token stripped, a signed asset caches exactly like an unsigned one.
"Unlimited requests means hotlinks cost nothing." Request counts and transferred bytes are billed separately. Plans without request fees still bill every terabyte delivered.
Hotlinking is not automatically illegal, but displaying copyrighted images or video without permission can create infringement liability depending on jurisdiction and context. Courts have treated inline linking differently over the years. For engineering teams, the practical answer is to enforce consent technically with referer rules or signed URLs, instead of relying on takedown requests after the bandwidth bill arrives.
Group your CDN access logs by the host in the Referer header, filtered to image and video responses, and rank the results by bytes transferred. Any domain you do not own with significant volume is hotlinking. Also compare the share of requests with an empty referer against your normal baseline, because a sudden rise often means app or forum reuse.
Hotlink protection can hide your images from image search results if the rules block crawlers or search result previews. Allowlist the major search engine referers and permit requests without a referer, which most crawlers send. Signed URLs should apply only to premium or private assets, never to the public images you want indexed and ranked.
Hotlink protection is the goal, and signed URLs are one way to reach it. Referer-based hotlink protection trusts a header that clients control, so it stops browsers but not determined tools. Signed URLs require a valid HMAC token and an expiry, verified at the edge, so a leaked link stops working after its expiry no matter which client uses it.
Pull 7 days of edge logs and sum the bytes served to referers outside your own domains, separately for images, video segments and downloads. Multiply the total by your effective per-TB rate. That figure tells you whether a referer allowlist is enough or whether your high-byte assets need signed URLs. Before you enforce anything, run the rules in log-only mode for 48 hours and count the false positives from empty referers.
If the heavy bytes turn out to be video or large files, BlazingCDN offers a 14-day testing period on real production traffic, with referrer rules and signed URLs included on every plan: start a BlazingCDN testing period with hotlink protection enabled.