Hotlinking

Hotlinking is embedding or serving someone else's hosted video or media directly from their server on an unauthorized site, consuming their bandwidth and bypassing their paywall. It is countered with domain and referrer restrictions, signed URLs, and token-based playback that ties access to the authorized site.

What is Hotlinking?

Hotlinking is embedding or serving someone else's hosted video directly from their server on a site that has no permission to use it. The original host bears the bandwidth cost, and any paywall or access rule on the source site is bypassed.

How It Happens

An unauthorized party copies a direct media URL or embed code and places it on their own page. Viewers there stream the file from the original host, who effectively subsidizes the theft and loses control over where the content appears.

How It Is Prevented

  • Domain and referrer restrictions: The player or CDN checks the requesting domain and refuses playback elsewhere.
  • Signed URLs: Time-limited, signed links stop static URLs from working indefinitely.
  • Token or OTP playback: Session-bound authorization means a copied embed will not play off-site.

For Platform Owners

Domain whitelisting combined with token-based playback is the standard defense: even if someone copies your embed, it only works on the domains you authorize.