Preventing File Hotlinking

[Ford Doctor]

Let's say you write an article or have a page where you have a list of documents that readers can download. In this case PDF files but it could be image files just the same. How do you prevent outside websites from linking directly to your files on your server?

[opentype]

So is it downloads or content embedded in those articles? And do you want to prevent embedding or any kind of access, like a plain link that opens the PDF/image et cetera?

[Ford Doctor]

Theoretically both. The files in question are listed as plain links on a page that are located in a dedicated folder in my main directory where IPS is installed. I have had embedded images hotlinked on me in he past a well. 

I went into my cPanel and found Hotlink Protection which I thought I had enabled but it was turned off. It is set up for all of my domains and the file types I want to protect. I just turned it back on... is there a way to test it?

My main concern is protecting pdf files that I offer which may be downloaded and I really do not care what becomes of them from there. I just want to prevent other websites from directly linking to them and stealing bandwidth. I want to resurrect a page that I disabled some time ago for this reason.

[opentype]

1 hour ago, Ford Doctor said:

is there a way to test it?

You can paste image URLs here in the editor and see what happens. If it works, it wouldn’t embed. Don’t even need to submit the post. 

1 hour ago, Ford Doctor said:

I just want to prevent other websites from directly linking to them and stealing bandwidth

Not sure why that is a concern to you. Is your host really charging that much that it matters? 
If so, I would probably rather run the site through something like Cloudflare to cache everything. 

[Telemacus2]

1 hour ago, opentype said:

Not sure why that is a concern to you. Is your host really charging that much that it matters? 

Sorry if this is a dumb question, but I don't fully understand your comment. Can you picture a scenario where a forum admin uploads a video file, say 1gig, only to be downloaded by his forum users, and then, say, a rival forum copies the link and lets all his users download the file?  Because I think many self hosted admins would get a quick email from their web-hosting company telling them that they need to upgrade their plan immediately.

And sure, in this particular case, it would be easier to upload the file to youtube and make it unlisted, but change video file to animation project or whatever... 

And, by the way, isn't cloudflare like 200$ a month?? 

[opentype]

14 minutes ago, Telemacus2 said:

Can you picture a scenario where a forum admin uploads a video file, say 1gig, only to be downloaded by his forum users, and then, say, a rival forum copies the link and lets all his users download the file? 

Of course, but that wasn’t the context. Individual JPGs, PDFs in an article are very different than 1 gigabyte video. I would hide the latter behind the Downloads app, which can prevent public download links. 
There are also not just bandwidth concerns. If someone hot-links some files from my article, at least I stay in control of that actual file and can remove it or change it again in the future. If I prevent linking, they might download the files and upload them to their own server, removing my control over the file entirely. That could be worse. There are many considerations … That’s why I asked so many questions. 

20 minutes ago, Telemacus2 said:

And, by the way, isn't cloudflare like 200$ a month?? 

Caching images and other resources is actually part of the free plan as well.  

[Telemacus2]

👍👍 Thanks, that makes a lot of sense.