Hotlink protection for local images – will social share cover images still work?
We store images locally on our WordPress server (no S3 or CDN) and want to protect them from hotlinking by blocking image requests from other websites, while still allowing images to load on our own site and when shared on social networks.
Is this safe to do with FluentCommunity, and will post cover images still appear correctly when posts are shared to Telegram, Facebook, X, or LinkedIn?
# Hotlink protection for images (allow our domain + allow empty referer)
<IfModule mod_rewrite.c>
RewriteEngine On
# If Referer is NOT empty...
RewriteCond %{HTTP_REFERER} !^$ [NC]
# ...and Referer is NOT our domain -> block
RewriteCond %{HTTP_REFERER} !^https?://(.*.)?jobblog.ru/ [NC]
RewriteRule .(jpe?g|png|gif|webp|avif|svg)$ - [F,NC,L]
</IfModule>
Hello Artur Abakarov
We use bunny (ref) for this.
All images pass through the CDN, and has hot link protection. While sharing on social or community, it just works fine because the referral is your own domain.
Hope it helps :)
PS.: take into account this is for main site and for any post or social you share in community that is from the site. For files from the community, you may need to use other layer (R2) or alike. There’s a bug atm with this, and we have not enabled it yet. So not sure how they get on together
Jorge de los Reyes that would indeed be an ideal setup.
Unfortunately, we are currently limited in using R2, and our S3 setup with VK Cloud didn’t allow us to properly configure CDN in a way that would work well with our media URLs. Because of that, we decided to keep media stored locally on the server for now.
If you use hotlink protection, you need to white-list social media, or the image will be blocked there, too. I don’t think your code will work as expected. You need to white-list allowed referrers.
André Daus your comment really helped clarify the risks.
It made us realize that hotlink protection at the server level is a fairly complex scenario, mainly because maintaining a reliable whitelist for social networks over time can be problematic. For now, we’ll likely avoid enabling hotlink protection and revisit it only if we encounter real, measurable issues with hotlinking in the future.
Shahjahan Jewel Is it technically possible to add this feature out of the box to Fcom or FluentAuth in the future?
Artur Abakarov This is kind of server config and should not be included in FluentAuth or FCOM.
Shahjahan Jewel thanks for the answer!