Exclude domains from hotlink protection

What is the name of the domain?

alifeadjacent.com

What is the error number?

none

What is the error message?

none

What is the issue you’re encountering

no preview image when sharing on some domains

What steps have you taken to resolve the issue?

One of my clients had another site hotlinking her images.

I turned on Hotlink Protection in Scrape Shield.

I created a Configuration Rule and in the settings added Hotlink Protection, and it is set to off.

The rule was created with a Custom filter expression as follows:
Field: Referer
Operator: contains
Value: names of platforms where she shares URLs

The first expression I created looks like this: (http.referer contains “pinterest”) or (http.referer contains “facebook”)

That broke the hotlinked images on the other site. And she can share on both Pinterest and Facebook just fine with the above.

But, she also wants to share on X/Twitter and Reddit. So I added the names twitter, x, and reddit to the expression. She reported there were no preview images when sharing on those platforms.

So I changed those 3 to be the domain with extension, instead of just the domain, like x.com, twitter.com, and reddit.com. The full Expression now looks like this:
(http.referer contains “pinterest”) or (http.referer contains “facebook”) or (http.referer contains “x.com”) or (http.referer contains “twitter.com”) or (http.referer contains “reddit.com”)

She reports that the preview image now sometimes shows up when sharing on X, but still not at all on Reddit.

In between changes, I purged Cloudflare and asked her to test after 4 hours and use different posts/images for the tests each time to ensure we had no caching issues.

What can I do/add to the expression to make X and Reddit work?

What are the steps to reproduce the issue?

Share an image or post from the site to X or Reddit

Hello!

Not every website serves their images and other assets with their primary domain, for example:

  • Reddit uses domains like external-preview.redd .it styles.redditmedia .com www.redditstatic .com among others.
  • YouTube uses googlevideo .com instead of www.youtube .com to serve videos and i.ytimg. com to serve the thumbnail images and so on.
  • I think Google uses gtatic. com to serve images…

You get it…

Now that your know that, you can check your firewall logs to view what domains are triggering Hotlink Protection and add them to the allowlist. Try sharing a link of your website, wait up to 5 minutes, refresh your firewall logs page and add the false positives to your allowlist.

Hope you do it.

2 Likes

Thank you so much for the examples and ways to see what’s hitting. I’ll definitely give that a try.

2 Likes

This topic was automatically closed after 15 days. New replies are no longer allowed.