Free tools Windows power users keep installed
One-click scans. No signup required.
The most practical way to deter ordinary image hotlinking in Nginx is to allow only trusted Referer values in the image location, then return 403 Forbidden when Nginx sets $invalid_referer. A typical rule is:
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
location ~* ..(?:jpg|jpeg|png|gif|webp|avif)$ {
valid_referers none blocked server_names *.example.com;
if ($invalid_referer) {
return 403;
}
}Replace the example host with every hostname that should be able to embed your files. This saves bandwidth from casual third-party embedding, but it is not authentication: a client can forge a Referer header or request the image directly.
As an Amazon Associate I earn from qualifying purchases.
What image hotlinking is and what this Nginx rule changes
Hotlinking occurs when another site places the URL of an image hosted on your server in its own HTML, CSS, forum post or application. Visitors see the image on the other site, but every request consumes your server’s bandwidth and may increase origin load. The other site also controls the context in which your image appears.
Nginx’s ngx_http_referer_module compares the request’s Referer header with an allowlist. The variable $invalid_referer is empty when the value matches and is 1 when it does not. Returning 403 for the latter denies the image request.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
This is a compatibility-focused deterrent, not a cryptographic access-control system. Browsers, privacy tools, email clients, native applications and restrictive referrer policies can omit the header. A downloader can also send a permitted header. Use signed, expiring URLs when the file must be private, paid or limited to a particular user.
Start with a narrowly scoped image location
Protect only the files that need protection. A dedicated directory is easier to audit than a global rule that catches every static asset.
Extension-based protection
location ~* ..(?:jpg|jpeg|png|gif|webp|avif)$ {
valid_referers none blocked server_names example.com www.example.com *.example.com;
if ($invalid_referer) {
return 403;
}
}The ~* modifier makes the regular expression case-insensitive. The pattern covers common raster and modern image formats. Add or remove extensions to match what your site actually serves. If image URLs include unusual extensions or extensionless paths, use a directory location or a more specific application rule instead of assuming this expression will match them.
Directory-based protection
location ^~ /images/ {
valid_referers none blocked server_names example.com www.example.com *.example.com;
if ($invalid_referer) {
return 403;
}
}A directory rule is useful when all content below /images/ is managed consistently. If that directory contains files that must remain publicly embeddable, split it into separate locations or protect selected extensions. Check how your existing prefix and regular-expression locations interact before deploying a new block; an earlier or more specific location may receive the request instead.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Understand every valid_referers token
The directive defines which Referer values Nginx considers valid. Put it inside the location that serves the protected files.
| Token or pattern | What it allows | When to use it |
|---|---|---|
none |
A request with no Referer header | Use when compatibility with bookmarks, privacy-focused clients, email, applications or restrictive referrer policies matters. |
blocked |
A Referer value that is present but has been removed or altered by an intermediary, commonly leaving a value that does not look like a normal URL | Use when firewalls, proxies or privacy gateways in your audience commonly strip the header. |
server_names |
The server names configured for the current request | Useful when all configured first-party names should be trusted and you want Nginx to derive them from the server configuration. |
example.com |
A specific host | List an apex domain explicitly when it should be allowed. |
*.example.com |
Hosts covered by the wildcard pattern | Allow approved subdomains such as an application or media host; verify that the wildcard is no broader than intended. |
example.com/path/ |
A host with an optional URI prefix | Narrow trust to a particular path when only part of an origin should be accepted. |
Host matching is case-insensitive. Include every legitimate first-party hostname: the apex domain, the www name, an application subdomain and a separate media subdomain if those are real embedding origins. Forgetting one creates false positives that look like broken images.
Choose a policy for missing Referer headers
Allow missing headers with none
Including none is the safer starting point for a public site. Direct navigation, a bookmark, some email links, privacy software and a restrictive Referrer-Policy can all result in no Referer. Allowing those requests avoids denying legitimate viewers, although it also means a direct request is not blocked by this rule.
Reject missing headers for stricter deterrence
Omit none when reducing anonymous embedding is more important than maximum compatibility. Test this choice against real traffic before making it global. A site that serves images to feeds, mobile applications or partner integrations may experience breakage if those clients do not send a Referer.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Decide whether to allow blocked
blocked accepts a header that an intermediary has stripped or replaced. It can preserve access for users behind corporate gateways and privacy proxies, but it weakens the signal slightly. Use it only when that behavior fits your audience and threat model.
Return a clear failure response
Use 403 Forbidden for a hard denial
if ($invalid_referer) {
return 403;
}A 403 response tells clients and operators that the request was deliberately refused. It is usually easier to monitor than silently serving an empty response. Keep the condition inside the protected location so unrelated pages and assets are unaffected.
Recommended Free Tools
Be cautious with placeholders and redirects
Some sites return a replacement image or redirect invalid requests. That can make a page look friendlier, but it adds cache considerations and can create redirect loops. The replacement file may itself become a popular hotlinked asset, and an incorrect cache key can cause a denied response to be reused for an allowed request. If you choose this approach, test browser caches, your CDN and intermediary caches separately. A plain 403 is the least surprising default.
Deploy the rule safely
- Inventory the assets. Identify the directories and extensions that should be protected. Exclude public assets that are intentionally embedded by customers, documentation, feeds or partner applications.
- List trusted origins. Write down the apex domain,
www, application hosts, media hosts and any approved partner origins. Do not rely on a wildcard when a short explicit list is practical. - Choose the missing-Referer policy. Start with
none blockedfor broad compatibility, or deliberately omit one or both tokens after considering your users and integrations. - Add the location rule. Use either the extension pattern or a dedicated directory block. Keep the rule close to the configuration that serves those files so future administrators can see its scope.
- Check the configuration. Run
nginx -tand fix any syntax or duplicate-location errors before reloading. A failed test should stop the rollout. - Reload during a controlled window. Use your normal Nginx reload procedure, such as
nginx -s reloador the service manager used by your distribution. Keep the previous configuration available for a quick rollback. - Test permitted and denied requests. Request an image with an allowed Referer, an untrusted Referer and no Referer. Confirm the status code and inspect the response through the same CDN or proxy path used by visitors.
- Watch logs after release. Look for 403 responses on legitimate pages, missing subdomains and clients that never send a Referer. Adjust the allowlist or missing-header policy only after identifying the actual caller.
Test the behavior with representative requests
You can reproduce the three important cases with a command-line client. Replace the URL with an image served by your protected location.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
# A first-party page
curl -I -e https://example.com/article/ https://example.com/images/photo.jpg
# A third-party page
curl -I -e https://other-site.invalid/page/ https://example.com/images/photo.jpg
# No Referer header
curl -I https://example.com/images/photo.jpgWith none present, the last request should be treated as valid by the Referer rule. With an untrusted origin, the rule should return 403. If you omit none, the no-header case should be denied. The exact response can still be affected by another location, authentication layer, CDN cache or application handler, so compare access logs with the command result.
Troubleshoot false positives and ineffective blocking
Your own page shows broken images
- Check whether the page uses
wwwwhile only the apex domain is allowed, or vice versa. - Add legitimate application, media and localized hostnames explicitly.
- Check whether a redirect changes the origin before the image request.
- Review the browser’s request headers and your access log to see whether the Referer is absent, altered or unexpectedly different.
- Confirm that the request is reaching the intended location rather than a more specific block elsewhere in the configuration.
Direct requests still work
That is expected when none is allowed. It is also expected for any client that can supply an allowed Referer. Referer filtering is designed to reduce ordinary third-party embedding, not to hide a public file from a determined downloader.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Hotlinked requests are not blocked
- Verify that the requested extension matches your regular expression, including uppercase variants and formats such as SVG or JPEG variants that you may have omitted.
- Confirm that the 403 condition is inside the location serving the image.
- Check whether a CDN or reverse proxy is serving a cached response generated before the rule was enabled.
- Inspect the actual Referer sent by the embedding site; a forged or allowed value will pass by design.
- Run
nginx -tand inspect the active configuration if a reload may have failed.
A privacy-focused client is denied
Decide whether that denial is acceptable. If it is not, allow none or blocked, or provide a separate access method for the affected application. Do not assume every missing header indicates abuse.
Know the security boundary of Referer filtering
NGINX’s documentation notes that fabricating a request with an appropriate Referer value is easy. A script, downloader or malicious site can send a trusted hostname even though the request did not originate from one of your pages. A user can also fetch the image URL directly and save it. Consequently, this technique is best viewed as a bandwidth-saving deterrent against ordinary browser hotlinking.
It does not provide user identity, entitlement, confidentiality or durable control over a public URL. Do not use it as the only protection for original files, paid downloads, private media or content whose access must expire.
Use signed URLs for private or expiring media
When access must be tied to a user, order or time window, generate a URL containing a signature and an expiry, then validate it at the edge. Nginx provides the optional ngx_http_secure_link_module, with the secure_link, secure_link_md5 and secure_link_secret directives. The module is not built by default; a source build requires --with-http_secure_link_module.
A signed-link design normally includes these parts:
- The application creates a token from the resource identifier, an expiry time and a secret known only to the application and validator.
- The application sends the signed URL to an authorized client.
- Nginx checks the signature and rejects an invalid or expired token before serving the file.
- The application and Nginx use consistent clocks, encoding rules and key rotation procedures.
This requires application changes, token generation, expiry handling and secret management. It is a different control from a Referer allowlist: use the latter for a low-effort hotlink deterrent and signed links when authorization actually matters.
Consider an edge-managed alternative
If your traffic already passes through Cloudflare, its Hotlink Protection feature can move the check out of the origin configuration. Cloudflare describes the feature as denying image requests when the HTTP Referer does not include the website domain. Its documented supported extensions are gif, ico, jpg, jpeg and png.
Cloudflare warns that enabling the feature can stop images from displaying on Google Images, Pinterest and Facebook. That indexing and social-sharing impact should be considered before activation. Confirm the current plan, account behavior and partner terms before making it part of an operational or commercial recommendation.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Choose the right approach
| Approach | Setup effort | Resistance to bypass | Compatibility considerations | Best fit |
|---|---|---|---|---|
| Nginx Referer allowlist | Low; configuration only | Low to medium because the header can be forged | Can break clients that omit Referer when none is not allowed |
Discouraging ordinary image embedding and reducing casual bandwidth theft |
| Nginx Secure Link | Higher; application token generation, expiry and an optional module | Higher when secrets are protected and links are short-lived | Requires application changes, clock coordination and URL-expiry handling | Private, paid or expiring media |
| Managed edge hotlink control | Low after provider setup | Depends on the provider’s policy and request signals | May affect search indexing and social image display | Teams already operating behind a CDN or WAF |
Operational checklist
- Scope the rule to the image directory or extensions that actually need protection.
- Allow the apex domain,
wwwand every legitimate first-party subdomain. - Make an explicit decision about
noneandblocked; do not omit them accidentally. - Use
$invalid_refererto return 403 only in the protected location. - Run
nginx -tbefore every reload and retain a rollback configuration. - Test allowed, untrusted and absent Referer cases through the real proxy or CDN path.
- Monitor 403 logs for false positives after deployment.
- Remember that Referer values are client-controlled and can be forged.
- Use signed, expiring URLs for content that requires real authorization.
- Assess search and social-display effects before enabling an edge-managed feature.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
