WP Toolkit Image Hotlink Protection
Knowledgebase Article
}
Knowledgebase Article
WP Toolkit includes an optional Hotlink Protection feature for WordPress sites. On our platforms this is disabled by default, but you can enable and tune it any time in cPanel.
This article explains what the feature does, when it’s useful, what it doesn’t affect, and how to modify or disable it if you ever run into sharing or preview issues.
When hotlink protection is enabled, your server checks where image requests come from.
This prevents third-party sites from embedding your images directly and using your bandwidth.
In short: hotlink protection stops other sites “borrowing” your hosted images without permission.
Hotlink protection can be useful if:
For most sites, it’s an optional security/bandwidth safeguard rather than something you must run.
Hotlink protection only applies to requests that look like they’re coming from external websites.
It won’t interfere with:
So if enabled correctly, your site should still display images normally for your audience.
WP Toolkit applies hotlink rules at the server configuration level, rather than changing files inside your site.
That means:
.htaccess.This is normal behaviour and helps keep WordPress files clean.

From there you can:
If you enable hotlink protection, you may want to allow certain external services to show your images. Examples include:
You can add these domains to the whitelist in WP Toolkit so they can load images normally while everyone else is blocked. Just click the configuration icon next to Hotlink protection.
Tip: Keep whitelists narrow and specific to avoid undoing the protection.
Occasionally, sharing tools or social platforms fetch images using their own domain as a referrer. If they’re not whitelisted, they may show a placeholder that includes a warning that the image was hotlinked:

If you see this only when sharing, it usually means WP Toolkit hotlink protection has been enabled and the platform’s domain isn’t on your whitelist.
You have two options:
After any change, clear your WordPress cache (if you use one) and try sharing again.
Powered by WHMCompleteSolution