iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The practical Nginx defense against ordinary image hotlinking is a valid_referers allowlist in the location that serves your images, followed by a response when $invalid_referer is set. This stops browsers arriving from unapproved sites with a 403 Forbidden, while still allowing your own pages. It is a bandwidth-saving deterrent, not an unbreakable access-control system: a client can forge the Referer header or request the image directly.
What image hotlinking is and what Nginx can prevent
Hotlinking occurs when another website embeds an image from your server instead of hosting its own copy. Every visitor to that page then causes a request to your Nginx server. You pay the transfer cost, your cache and origin handle the traffic, and the other site receives the visual asset.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBrowsers commonly send the page that initiated an image request in the HTTP Referer header (the spelling is part of the HTTP field name). Nginx’s ngx_http_referer_module compares that value with an allowlist. It sets $invalid_referer to an empty string when the value is accepted and to 1 when it is not. A conditional return can then deny the request.
This protects against routine browser embedding. It does not prove who is downloading a file. A script, command-line client, or determined downloader can send an approved Referer value, omit the header, or fetch a publicly known URL directly. Use signed, expiring URLs for private, paid, or user-specific media.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
The basic Nginx configuration
Place the rule in the location that serves the images. Replace the example hostnames with every legitimate hostname that should be able to embed them.
location ~* .(?:jpg|jpeg|png|gif|webp|avif)$ {
valid_referers none blocked server_names example.com www.example.com *.example.com;
if ($invalid_referer) {
return 403;
}
}The regular-expression location matches the listed extensions without regard to case. It is convenient when images are distributed throughout a site, but a dedicated directory is easier to audit. If all protected files live below /images/, use a path-scoped location instead:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11location ^~ /images/ {
valid_referers none blocked server_names example.com www.example.com *.example.com;
if ($invalid_referer) {
return 403;
}
}Choose one scope deliberately. A broad extension rule can also affect assets used by an application, an API response that happens to end in an image suffix, or a tenant that needs different rules. A directory rule avoids those surprises, provided protected images consistently live there. If user uploads are stored in a separate directory, protect that directory rather than every static asset on the server.
How valid_referers decides whether a request is trusted
The directive accepts several kinds of entries. They are evaluated as an allowlist; a request that matches none of them makes $invalid_referer equal to 1.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
| Entry | Meaning | When to use it |
|---|---|---|
none |
Accepts a request with no Referer header. | Use when bookmarks, privacy settings, email clients, native apps, or other legitimate clients must continue to work. |
blocked |
Accepts a Referer field that is present but has been removed or altered by a firewall or proxy. | Use only if that behavior is expected in your delivery path. |
server_names |
Accepts the server names configured for the current virtual server. | Useful when the same Nginx server block lists all first-party names. |
| A hostname | Accepts that host, such as example.com or www.example.com. |
List each required first-party hostname explicitly when you want a clear, reviewable policy. |
| A host pattern or regular expression | Matches a family of approved origins. | Use for controlled subdomains or a narrowly defined partner origin; test the expression before deployment. |
Host matching is case-insensitive. Include the apex domain and its www form separately unless server_names already covers both. Add legitimate application, media, staging, or regional subdomains only when they really need to embed the files. An optional URI prefix can narrow an allowed origin when only part of that site should be trusted.
Decide what to do with a missing Referer
Allowing none is the compatibility-first choice. It means a visitor who pastes an image URL into a browser, follows a link from an email, uses a privacy-focused browser, or arrives from a page whose Referrer-Policy suppresses the header is not blocked. The trade-off is that a hotlinker can also omit the header and still receive the image.
Removing none makes the rule stricter: every request must supply an accepted origin (or satisfy another entry such as blocked). That can stop more casual embeds, but it also creates false positives for legitimate clients. Nginx’s documentation specifically cautions that legitimate browsers may send no Referer and that fabricating an acceptable value is easy.
blocked is a separate policy decision. It accepts a header that an intermediary has stripped, rather than a genuinely absent header. Keep it when your reverse proxy, privacy gateway, or firewall is known to produce that form; omit it when you want those requests rejected.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Implement the rule safely
- Inventory the URLs and hosts. Identify the image directories or extensions to protect. List every first-party hostname that embeds them, including
www, application subdomains, and any media hostname. Decide whether search previews, email clients, or mobile applications need no-Referer access. - Edit the correct server block. Add
valid_referersand the conditional return inside the image-servinglocation, not in an unrelated virtual host. If a more specific location already handles uploads or a CDN path, put the rule there. - Start with an explicit allowlist. A readable example is
valid_referers none blocked server_names example.com www.example.com *.example.com;. Remove entries that do not match your delivery model, and add controlled origins only when necessary. - Choose the failure response.
return 403;clearly communicates that the request is forbidden. A redirect to a placeholder can add complexity: caches may retain the redirect, the placeholder can itself be embedded, and a careless rule can create redirect loops. Use a replacement image only after considering those effects. - Check the syntax before reloading. Run
nginx -twith the same privileges and configuration path used by your service. Correct syntax, missing semicolons, unmatched braces, and an accidentally edited server block before applying the change. - Reload in a controlled window. Use your operating system’s normal Nginx reload procedure after the test succeeds. Watch error and access logs while checking real pages so a rejected request can be tied to its Referer and location.
- Review false positives. If your own pages show broken images, compare the hostname in the page with the entries in
valid_referers. Check whether a proxy has removed the header and whether the request is actually being served by a different location.
Test the behavior from several request types
Test with a real protected URL and a disposable image before relying on the rule. The following requests let you exercise the three important cases:
# No Referer (allowed when `none` is present)
curl -I https://example.com/images/photo.jpg
# A trusted page (should be allowed)
curl -I -e https://www.example.com/article https://example.com/images/photo.jpg
# An untrusted page (should receive 403)
curl -I -e https://other-site.example/article https://example.com/images/photo.jpgThe command output should correspond to your chosen policy: a request with no header is accepted only when none is listed, a first-party value matches the allowlist, and an unapproved value reaches the return 403 branch. If all requests are allowed, confirm that the request is hitting the intended location and that Nginx was reloaded with the edited configuration. If all requests are denied, check the hostname spelling, the presence of none or blocked, and whether the browser or proxy is sending a different origin than expected.
Common configuration problems and fixes
Your own site receives 403 responses
List every actual first-party origin. A page on www.example.com is not the same string as a page on example.com for an explicit allowlist. The same applies to an application subdomain, a regional hostname, or a separate media host. If privacy controls intentionally suppress Referer on some traffic, retain none or accept that those requests cannot use a strict policy.
Images work in pages but fail from email or chat
Email clients, messaging applications, and privacy gateways often omit or rewrite the header. A strict list without none will reject those requests. Decide whether those clients are part of your audience; if they are, allowing none is usually the practical choice.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
A proxy or firewall changes the header
Inspect the request as it reaches Nginx. If the intermediary sends a stripped or altered field rather than no field, blocked may match the intended behavior. Do not add it automatically: accepting all intermediary-stripped requests may undermine a policy that deliberately requires a known origin.
The rule catches files that should remain public
Narrow the location. Replace a global extension match with a dedicated directory, or create separate locations for public and protected uploads. Include only the extensions you actually serve; add another suffix only after confirming it is part of the protected set.
Free tools Windows power users keep installed
One-click scans. No signup required.
A placeholder causes unexpected traffic
Any replacement response has its own caching and access behavior. Ensure the placeholder is outside the protected location or explicitly allowed, and check that a redirect cannot point back to the same rule. A direct 403 is simpler when the goal is only to stop bandwidth-consuming embeds.
Know the limits of Referer protection
The Referer field is supplied by the client. A downloader can send an allowed value, use a tool that does not follow browser conventions, or call the image URL directly. A public image URL also remains discoverable through page source, browser caches, search indexes, and previously shared links. Consequently, this Nginx pattern reduces ordinary third-party embedding; it does not make an image private and should not be used as authentication.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Do not treat a successful 403 test as proof that the files are inaccessible. Test with an allowed Referer, an untrusted Referer, no Referer, and a direct request, then choose a policy that matches the value of the content and the compatibility you need.
When to use signed and expiring URLs instead
For paid downloads, private media, or access tied to a user or account, generate a URL containing a short-lived signature and validate it at the edge. Nginx’s optional ngx_http_secure_link_module provides the secure_link, secure_link_md5, and secure_link_secret directives for this type of check.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The module is not built by default. A source build must include --with-http_secure_link_module; verify how your Nginx package was compiled before designing around it. Your application must create tokens, define an expiry time, protect the signing secret, and handle clock differences and expired links. Those responsibilities make signed links a larger implementation than a Referer allowlist, but the token—not a client-controlled header—becomes the authorization signal.
Use the approaches for different jobs:
- Referer allowlist: low setup effort and useful for discouraging routine image embedding.
- Secure Link: appropriate when a request must be tied to a secret, a user, or an expiration time.
- Application authorization: necessary when access depends on a session, entitlement, or audit trail rather than on the URL alone.
Using a managed edge feature
If your site already runs behind Cloudflare, its Hotlink Protection feature can enforce an edge-level policy instead of adding the check to the origin configuration. Cloudflare describes the feature as denying image requests when the HTTP Referer does not include the website domain. Its documented supported extensions are gif, ico, jpg, jpeg, and png.
That convenience has a presentation trade-off. Cloudflare warns that enabling Hotlink Protection can prevent images from appearing on Google Images, Pinterest, and Facebook. Those services may be important sources of discovery or sharing, so check the current behavior, plan requirements, and any partner terms before enabling it. A managed edge rule also does not turn a public image URL into private media; use signed links when authorization matters.
Quick Recap
Which approach fits your situation?
| Approach | Setup effort | Resistance to bypass | Compatibility considerations | Best fit |
|---|---|---|---|---|
| Nginx Referer allowlist | Low; configuration only | Low to medium because the header can be forged | Rejecting no-Referer clients can break legitimate traffic | Discouraging ordinary browser hotlinking |
| Nginx Secure Link | Higher; token generation, expiry handling, and an optional module | Higher when signatures are secret, valid, and short-lived | Requires application changes and clock/key management | Private, paid, or expiring media |
| Managed edge hotlink control | Low after provider setup | Depends on the provider’s policy and request signals | May affect search and social image display | Teams already operating behind a CDN or WAF |
Operational checklist
- Protect only the image directories or extensions that need protection.
- List the apex,
www, application, and media hostnames that legitimately embed images. - Choose deliberately between allowing
none, acceptingblocked, and requiring an approved Referer. - Return
403unless you have a tested reason to serve a placeholder or redirect. - Run
nginx -t, reload safely, and inspect logs for false positives. - Test trusted, untrusted, missing, and direct requests.
- Use signed, expiring URLs—not Referer checks—for authorization of private or paid files.
- If using a managed edge feature, verify its current extension support and its effect on search and social previews.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
