Hotlink protection Pro

Hotlinking is another site linking straight at your download URLs, so their visitors get your files and you get the bandwidth bill. Switch it on under Documents → Settings → Downloads → Hotlink protection.

What gets refused

Only requests that arrive carrying a referrer from another site. That is the whole rule, and the exceptions matter more than the rule:

• No referrer at all → allowed. A pasted URL, a bookmark, and most email clients send no referrer. Refusing those would break ordinary use without stopping a determined hotlinker.
• Your own pages → allowed, obviously.
• Signed share links → always allowed <!– claim-ok: verified by the integration suite — "a signed share link is exempt from hotlink protection" –>, including single-use links. They are meant to be forwarded, and a recipient clicking one out of webmail legitimately arrives with a foreign referrer.

Allowing specific other sites

If you syndicate downloads to a partner site, add its host with a filter:

add_filter( 'filedeck_hotlink_allowed_hosts', function ( $hosts ) {
	$hosts[] = 'partner.example.com';
	return $hosts;
} );

What it is and isn’t

Referrers are sent by the browser and can be omitted or forged, so hotlink protection raises the cost of casually embedding your files — it does not make them unobtainable. Anyone determined can fetch the URL without a referrer.

If a file genuinely must not be fetched by the wrong people, that is an access question, not a bandwidth one: use access control, IP rules, or keep it in a restricted category so it lives in the protected vault.