How to Stop Image Hotlinking on a Gaming Fan Site

The first time hotlinking cost me money, it was a boss fight screenshot. I had posted a weapon drop table with eight images for a raid guide, the post did well, and within a week three aggregator sites had copied the whole table into their own pages. They copied the text, which is annoying, and they linked straight to my image files, which is expensive. My host's bandwidth graph went from a steady 14 GB a month to 61 GB, and none of that traffic ever landed on my site.

That is hotlinking: another site displaying your image by pointing at the file on your server, so your host pays to deliver it and their page gets the credit. Gaming sites get hit harder than most because screenshots, maps and item icons are exactly what other people want and nobody wants to recreate. Here is how to find out whether it is happening to you, and how to stop it without breaking the embeds you actually want.

Confirm it is hotlinking before you change anything

Bandwidth can spike for plenty of reasons: a post going well, an uncompressed image someone finally clicked, a badly behaved crawler, a backup plugin writing to a public folder. Treat the diagnosis as the first job.

The signal you are looking for is image requests with a referrer that is not your domain. If you are behind Cloudflare, the analytics panel will break traffic down by referring host and by file type, and hotlinked images show up as a large share of requests with almost no page views attached. On a plain shared host, the raw access logs in cPanel carry the same information in the referrer field, and the pattern is unmistakable: hundreds of requests for the same three jpg files, all with the same foreign referrer, no html requests at all.

A quick sanity check that takes a minute: pick your most popular screenshot, search for it with a reverse image search, and look at whether the sites showing it are loading it from your URL. If the image URL on their page starts with your domain, you have found your answer.

Two numbers are worth writing down before you fix anything, because they tell you how much the fix is worth. One is your current monthly transfer. The other is what your host charges over the allowance. Most shared plans include somewhere between 50 GB and unmetered transfer, and the ones with overage pricing tend to sit around 0.08 to 0.12 per gigabyte, which is small until a wiki with 4,000 images gets scraped by a site with real traffic.

Decide what you want to allow

This is the step almost every guide skips, and skipping it is how people break their own site.

Your images are requested by more than browsers on your pages. Discord unfurls a link preview using your image. Reddit and Bluesky pull a thumbnail. Google Images needs to fetch the file to show it in results, and so does Google Discover. If you block every request without a matching referrer, you will also block some of those, and the usual symptom is a broken grey box where your preview card used to be in your own community's Discord.

So write a short allow list before you touch a setting. Mine is my own domain and subdomains, the search engine image fetchers, Discord, and the two forums where my guides get shared legitimately. Everything else gets refused. If your community lives mostly on Discord, that one entry matters more than all the blocking.

Turning it on, in the order that causes the least breakage

If you use Cloudflare, start there. Hotlink protection is a single switch in the security settings, it works at the edge so the request never reaches your server, and it is available on the free plan. It leaves search engine crawlers alone by design. Turn it on and give it an hour before judging anything.
Add an exception folder. Cloudflare's protection ignores any path containing hotlink-ok, so put the images you genuinely want other sites to use, your logo, press shots, an emblem you want clans to display, in a folder with that string in its name.
If you are not on a CDN, use the host's own tool. cPanel has a hotlink protection page where you list allowed referring domains and the file extensions to protect. It writes the server rules for you, which is safer than editing configuration files by hand on a live site.
On WordPress without either, use a plugin rather than a snippet. Several security plugins include referrer blocking, and they survive theme updates. A rule pasted into a theme file does not.
Serve a replacement image instead of an error. This is the part worth the extra ten minutes. Rather than returning a blocked response, point refused requests at a small image that says where the original lives. The scraper's page then advertises your site to its readers, and a 12 KB placeholder costs almost nothing to serve.
Verify from outside your own browser. Open a referrer testing page, paste one of your image URLs, and confirm it is refused. Then open your site in a private window and confirm your own images still load, and post a link in a quiet Discord channel to check the preview card still appears.

Expect the bandwidth graph to take two or three days to settle, because caches on the other end keep serving the old file for a while.

Why watermarking everything is the wrong fix

The advice you will see most often is to watermark your images so that at least you get credit when they are stolen. I did this for about six months across roughly 300 screenshots, and I regret the time.

A watermark does nothing about the actual cost. Your server still delivers the file, still eats the transfer, still slows down for your own readers under load. The only thing a watermark changes is attribution, and sites that scrape tables wholesale are not an audience that was ever going to click a credit line. Meanwhile a visible watermark makes the screenshot worse for the people you wrote the guide for, and it makes the image less likely to be picked up in the image search results you do want.

There is also a quieter cost. Watermarking usually means re-encoding, and re-encoding a PNG screenshot into a watermarked JPEG tends to blur exactly the thing readers came for, which is the small text in a stats panel. If you are going to re-process images, spend the effort on compressing them properly instead, and keep the pixels clean.

Block the referrer, serve a placeholder, keep the image clean. That ordering has held up for me across two sites.

What to do about the copied text while you are in there

Hotlinking usually travels with wholesale content copying, and the image fix does not touch that. The realistic options are a polite removal request, a copyright complaint to the host or to search, and making sure your own version is clearly the original by keeping your publish dates and your screenshot alt text in order.

What I would not do is spend weeks chasing small aggregators. Most of them have no traffic. I now check once a quarter, deal with anything that actually ranks above me, and ignore the rest. The rest of the web tips section covers the parts of this that affect search more directly.

FAQ

Will hotlink protection hurt my search rankings?

Not if it is configured to allow the image crawlers. Cloudflare's switch already does. If you build your own rules, allow requests with an empty referrer, because that is how several legitimate fetchers and some browsers identify themselves, and blocking those is the usual cause of images vanishing from image search.

How do I know how much bandwidth hotlinking is actually using?

Compare total image transfer against image requests carrying your own referrer. On Cloudflare the analytics split by referring host gives you this directly. On a shared host, your log analyser will show requests by file and referrer for the last month, and the gap between the two figures is your answer.

Does moving images to a free image host solve it?

It moves the cost, and it introduces a new problem. Free image hosts delete files, rate limit, add their own compression, and they mean your images no longer live on your domain, which costs you image search traffic. For a fan site I would keep images on the domain and put a CDN in front.

Can I block specific sites rather than all of them?

You can, and it is tempting, but it ages badly. A deny list needs updating every time a new scraper appears, while an allow list keeps working. I only use a deny entry for the occasional site that works around referrer rules.