Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTo stop ordinary websites from embedding your images and consuming your bandwidth, add a valid_referers allowlist to the Nginx location that serves those images, then return 403 Forbidden when $invalid_referer is set. A practical baseline is:
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
location ~* .(?:jpg|jpeg|png|gif|webp|avif)$ {
valid_referers none blocked server_names *.example.com;
if ($invalid_referer) {
return 403;
}
}Replace example.com with every hostname that should be trusted, and narrow the location to the directory or file types that actually need protection. This reduces casual hotlinking, but it is not a cryptographic security boundary: a client can forge an HTTP Referer header or download the image directly.
As an Amazon Associate I earn from qualifying purchases.
What image hotlinking is and why it matters
Hotlinking occurs when another site places an image URL from your server directly in its own HTML, forum post, app, or advertising creative. A visitor then requests the file from your Nginx server while viewing the other site. Your server pays the bandwidth and handles the request, but the other site receives the visual benefit.
The impact is usually wasted transfer capacity and extra origin requests. It can also make traffic reports harder to interpret, because requests generated by pages you do not control appear alongside your own visitors. Referer filtering addresses the common browser case without requiring an application change.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Nginx implements this control through the ngx_http_referer_module. The module compares the request’s Referer value with the entries in valid_referers. It sets $invalid_referer to an empty string for a valid match and to 1 when the value does not match. Your location can use that variable to deny the request.
Choose the files and hosts to protect
Prefer a dedicated image location
A location dedicated to images is easier to audit than a rule applied to every static asset. If uploads live under /images/, /media/, or a similar path, put the policy there. A directory-specific rule avoids accidentally blocking stylesheets, JavaScript, downloadable files, or API responses that have different compatibility requirements.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
location ^~ /images/ {
valid_referers none blocked server_names *.example.com;
if ($invalid_referer) {
return 403;
}
}If your server stores images in several paths, use separate locations or a carefully scoped regular-expression location. The goal is to protect only the resources for which third-party embedding is a problem.
Restrict by extension when necessary
For a site where image files are mixed with other content, match the extensions you want to protect:
location ~* .(?:jpg|jpeg|png|gif|webp|avif)$ {
valid_referers none blocked server_names *.example.com;
if ($invalid_referer) {
return 403;
}
}The ~* modifier makes the extension comparison case-insensitive. Add or remove extensions according to the formats you actually serve. Do not assume that protecting one pattern automatically covers files served through a different location block.
List every legitimate first-party hostname
Include the apex domain, the www hostname, and any application or media subdomain that legitimately embeds the files. Host matching is case-insensitive. A wildcard such as *.example.com covers subdomains beneath that name; use entries that reflect your real hostname structure rather than allowing an unnecessarily broad domain.
Recommended Free Tools
Where an origin should be trusted only for a particular path, an optional URI prefix can narrow the allowed match. Regular-expression entries can handle more specialized host patterns, but they deserve extra review because an overly broad expression can defeat the allowlist.
Understand the Referer choices
The tokens on the valid_referers line represent different header conditions. Select them deliberately; the choice determines whether privacy-focused and non-browser clients continue to work.
none: accepts a request with noRefererheader. This is the compatibility-friendly choice for bookmarks, privacy tools, email clients, native applications, and browsers affected by a restrictiveReferrer-Policy.blocked: accepts a header that an intermediary has removed or altered in a way Nginx recognizes as blocked. This can help when a firewall, proxy, or privacy layer strips the value.server_names: accepts requests whose Referer matches the server names configured for the current server block.- Host names, wildcards, and regular expressions: add specific trusted origins, such as your apex domain,
www, or a controlled media subdomain.
Allowing none means an image can still be requested without a Referer, so it does not stop every possible embed. Omitting it makes the policy stricter, but legitimate visitors who arrive without the header will receive the failure response. There is no universally correct setting: decide whether bandwidth reduction or maximum compatibility is more important for your audience.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
How matching affects real requests
A browser loading an image from a page on www.example.com normally sends a Referer containing that page’s origin or URL. The allowlist can match that host and let the request continue. A page on an unrelated domain produces a different host and sets $invalid_referer to 1. A bookmark, a privacy tool, or a client following a restrictive referrer policy may send no header at all; that request is accepted only when none is present.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do not treat the header as proof of identity. It is merely an input to a routing decision. Hostname entries should describe origins you actually operate or explicitly trust, and every new front end, media host, or application host should be added before it starts embedding protected files.
Build the Nginx rule
Basic allowlist with a 403 response
For a site whose primary host is example.com and whose images are identified by extension, use:
location ~* .(?:jpg|jpeg|png|gif|webp|avif)$ {
valid_referers none blocked server_names *.example.com;
if ($invalid_referer) {
return 403;
}
}The if statement is used here only with return, which makes the decision explicit: a non-matching Referer receives 403 Forbidden. Requests that match the allowlist continue through the normal static-file handling for the location.
Make the hostname list explicit
If you want to document each approved origin rather than rely on a wildcard, list them on the directive:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →location ^~ /images/ {
valid_referers none blocked example.com www.example.com media.example.com;
if ($invalid_referer) {
return 403;
}
}This form makes future changes visible during configuration review. Add a hostname before deploying a new front end, image CDN origin, or application subdomain that embeds the files.
Use a path prefix when trust should be narrow
An allowed host can optionally be paired with a URI prefix. This is useful when a trusted origin should be allowed to embed only a particular part of the image tree. Keep the prefix specific enough that an unrelated path on the same origin does not gain access accidentally. Review such entries whenever the URL layout changes.
Decide whether to allow direct requests
Directly opening an image URL in a browser commonly produces no Referer. With none present, that request remains allowed. Without it, the same action can return 403. Test this behavior intentionally, because support teams often use direct URLs while diagnosing an image problem.
Choose the failure response
403 Forbidden
A 403 clearly communicates that the request was rejected by policy and avoids serving additional content. It is the simplest response for a bandwidth-deterrence rule and works well with the example configuration. It also makes denials easy to identify in access logs and monitoring.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Placeholder images
A placeholder can preserve page layout, but it changes the caching and operational profile. If the placeholder is served from a URL that is itself publicly embeddable, another site may hotlink that file instead. Caches can also retain a response longer than expected, so define cache behavior before adopting this option. Test the placeholder through every cache and image-resizing layer in front of Nginx.
Redirects
Redirecting a rejected request to another image introduces extra requests and can create loops if the destination is covered by the same rule. It may also make the replacement image a new hotlink target. Use a redirect only after checking the destination, cache headers, and behavior through every proxy in front of Nginx. A plain denial is usually easier to reason about and cheaper to operate.
Validate and deploy safely
- Confirm the location match. Check that the requested image actually reaches the location containing
valid_referers. A more specific location block may take precedence over the rule you edited. - Check the configuration syntax. Run
nginx -twith the same configuration context used by the service. Fix every reported error before reloading. - Reload during a controlled window. After a successful syntax check, reload Nginx using your operating system’s service procedure. A reload applies the new configuration without requiring a full stop/start cycle.
- Test an approved page. Load a page on each first-party hostname that embeds a protected image. Verify both the page and any lazy-loaded image requests.
- Test an unapproved origin. Send a request with a different Referer and confirm that the expected denial response is returned. Use a controlled test page or an HTTP client that lets you set headers.
- Test with no Referer. Remove the header and verify that the result matches your chosen
nonepolicy. - Review access logs. Look for legitimate clients receiving denials, then adjust the hostname list or missing-header policy rather than broadly disabling the rule.
Keep a rollback copy of the previous server configuration. If image failures appear after deployment, restore the prior version while you identify the missing origin, location precedence issue, or header behavior.
Test at both origin and edge
If a CDN, reverse proxy, or cache sits in front of Nginx, test the same URL through the public hostname and directly against the origin when possible. An edge may serve an older cached response, remove the Referer header, or generate the response itself. Comparing both paths shows whether a denial or an approval came from Nginx or from another layer.
Diagnose common false positives
Your own pages return 403
- Check whether the page uses an unlisted hostname, such as
wwwor a media subdomain. - Inspect the actual Referer sent by the browser; a redirect or embedded frame can change the origin you expected.
- Confirm that the request is not being served by a different location block with its own policy.
- If the browser legitimately sends no Referer, add
noneor accept that direct and privacy-restricted requests will be denied.
Users behind a proxy cannot see images
Some intermediaries strip or suppress the header. If that audience is important, evaluate whether blocked should be allowed and whether none provides better compatibility. Do not infer that an absent value proves malicious hotlinking; it may be a deliberate privacy setting.
Only some formats fail
Compare the failing URL with the extension expression and inspect which location handled it. Uppercase extensions are covered by ~*; files with extensions outside the expression require an additional entry or a directory-based rule.
A CDN or cache appears to ignore the change
An edge cache may continue serving an earlier response after the origin policy changes. Purge or revalidate the relevant cache according to that system’s procedures, then retest at the origin and through the edge. Also check whether the edge, rather than Nginx, is generating the response.
A new subdomain breaks after a deployment
Modern sites often add an application host, media host, preview host, or separate front end. If that host embeds images but is absent from valid_referers, its requests fail even though the content is yours. Add only the legitimate hostname, test it, and avoid solving the problem by permitting an unnecessarily broad domain.
Know what Referer protection cannot do
The Referer header is supplied by the client. NGINX documentation notes that fabricating an appropriate value is easy. A determined downloader can send an allowed hostname, request the image directly, save a previously delivered copy, or use a tool that does not follow your browser-oriented assumptions.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Referer filtering is therefore a deterrent for ordinary browser hotlinking, not an authorization system. It is a good fit when the principal goal is reducing casual third-party embedding and associated bandwidth. It is not sufficient for confidential media, paid downloads, or content that must be available only to a particular user.
What it does and does not protect
The rule protects requests that reach the selected Nginx location and fail the configured Referer test. It does not erase copies that have already been downloaded, stop a client that supplies a trusted header, or control images copied to another server. It also does not automatically cover files handled by another location, another origin, or an edge cache with its own policy.
Use signed URLs for private or expiring media
For per-user or time-limited access, generate URLs containing a signature and an expiry, then validate them at the edge. Nginx provides this through the optional ngx_http_secure_link_module, using directives such as secure_link, secure_link_md5, and secure_link_secret.
The module is not built by default. A source build requires --with-http_secure_link_module. Confirm that the running Nginx binary includes the module before designing a deployment around it.
Signed links require application-side token generation, synchronized time and expiry handling, and secure key management. They add stronger control than a Referer allowlist, but they also add application work: every legitimate consumer must receive a current URL, and expired links must fail predictably. Use this model when the resource itself needs authorization rather than merely discouraging third-party embedding.
When the extra complexity is justified
Use Secure Link when a user, purchase, subscription, or short access window determines whether a file should be delivered. The setup effort is higher because the application must create tokens and handle expiry, and operators must protect the signing secret. For a public image library where the goal is simply to reduce casual bandwidth theft, that machinery is usually unnecessary.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Consider an edge-managed alternative
If the site already operates behind Cloudflare, its Hotlink Protection feature can enforce the check at the edge. Cloudflare describes the feature as denying image requests when the HTTP Referer does not include the website domain. Its documented supported extensions are gif, ico, jpg, jpeg, and png.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Moving the decision to the edge can reduce requests reaching the origin and avoids editing each Nginx server. The trade-off is compatibility: Cloudflare warns that enabling the feature can prevent images from displaying on Google Images, Pinterest, and Facebook. Verify the current plan, feature behavior, and any partner terms before treating it as a production recommendation.
An edge rule can be attractive for teams already paying for and operating a CDN or WAF, but it is not automatically better. Confirm which extensions are covered, how missing Referer values are handled, whether cached responses are purged, and whether search or social previews matter to the business.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Compare the three approaches
| Axis | Nginx Referer allowlist | Nginx Secure Link | Managed edge hotlink control |
|---|---|---|---|
| Setup effort | Low; configuration only | Higher; token generation and an optional module | Low after provider setup |
| Bypass resistance | Low to medium; the header can be forged | Higher when tokens are secret, signed, and short-lived | Depends on provider policy and request signals |
| Compatibility | Can break no-Referer clients if none is not allowed |
Requires application changes and URL-expiry handling | May affect search and social image display |
| Best use | Discouraging ordinary image embedding | Private, paid, or expiring media | Teams already operating behind a CDN or WAF |
There is no single universal winner. The Nginx allowlist has the lowest setup effort and no token-generation cost, but it offers only deterrence. Secure Link requires engineering and key-management effort in exchange for stronger authorization. An edge feature can reduce origin work when a provider is already in place, while introducing provider-specific behavior and possible indexing or social-display trade-offs.
Operational checklist
- Scope the rule to the image directory or extensions that need protection.
- List the apex,
www, application, and media hostnames that legitimately embed images. - Choose deliberately whether to allow
noneandblocked. - Use
$invalid_refererfor the denial decision and return a clear status such as403. - Run
nginx -tbefore every reload. - Test approved, unapproved, and missing-Referer requests.
- Inspect logs for false positives after deployment.
- Check location precedence and edge-cache behavior when results are unexpected.
- Use signed, expiring links when access must be tied to a user or purchase.
- Check search and social-display consequences before enabling an edge-wide hotlink feature.
Frequently Asked Questions
Does this stop every image downloader?
No. A Referer value is client-controlled, so a determined client can forge an allowed value, fetch the file directly, or save a copy that was already delivered. The rule mainly discourages ordinary browser hotlinking.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should I include none in valid_referers?
Include it when compatibility matters for bookmarks, privacy tools, email clients, native applications, or browsers that omit the header. Remove it only when you deliberately want stricter enforcement and accept that legitimate no-Referer requests may receive 403.
What is the purpose of blocked?
It allows a Referer that an intermediary has stripped or altered in a way Nginx recognizes as blocked. It can help users behind a firewall, proxy, or privacy layer, but whether to permit it depends on your audience and threat model.
Do I need both the apex and www hostnames?
Yes, if both hosts legitimately serve pages that embed the protected images. Add application and media subdomains as needed. A wildcard such as *.example.com covers subdomains beneath that name, but avoid broad entries that trust more hosts than necessary.
Why do my own images return 403 after enabling the rule?
The page may use an unlisted hostname, send no Referer, or be handled by a different location block. Check the actual request header, location precedence, and whether none should be allowed.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Is a placeholder better than a 403?
A placeholder can preserve layout, but it adds caching and bandwidth considerations. The placeholder URL can itself become a hotlink target, and caches may retain it longer than expected. A 403 is simpler when denial is the goal.
When should I use Nginx Secure Link instead?
Use signed, expiring URLs for private, paid, or per-user media. The optional module provides stronger access control, but it requires application token generation, expiry handling, key management, and a build that includes --with-http_secure_link_module.
Can Cloudflare Hotlink Protection replace the Nginx rule?
It can move the check to the edge for sites already using Cloudflare. Cloudflare documents support for GIF, ICO, JPG, JPEG, and PNG and warns that the feature can affect Google Images, Pinterest, and Facebook. Verify current plan and behavior before enabling it.
Why does a CDN seem to ignore my new configuration?
The edge may still be serving a cached response or generating the response itself. Purge or revalidate the relevant cache, test the origin separately, and confirm which layer handled the request.
The Bottom Line
Use a narrowly scoped valid_referers rule and $invalid_referer to return 403 for ordinary hotlink attempts. Allow none and blocked only when their compatibility benefits fit your audience, and list every legitimate first-party hostname. Treat Referer checks as a bandwidth deterrent, not authorization; use signed Secure Link URLs for private or expiring media, or an edge-managed feature when its compatibility trade-offs are acceptable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
