I'm trying to determine the best way to handle a few issues I've come up with on handling images for my site.

Background: A small site that houses movie information. I have an admin section to upload multiple movies images per movie.

Image files would be hosted on a CDN so access would pretty much be open. References to each image will be stored in the database.

I would like to: 1) Make sure I can prevent hot-linking as much as possible 2) Have the filename some what obfuscated to prevent a scraper from just increment an id parameter in the URL.

So far, I'm using a random string generator to come up with the image names which I believe takes care of #2.

Looking for an answer to #1 and also any advice and best practices.


The best defence is to require the user to create an account and log in before giving them the information.

You can use a CAPTCHA as part of the login without affecting the user experience too much. Or throw one in on every link if you value security over usability.

Once the user is logged in you can offer them user specific links. Which can be removed if overused.

If your information is valuable enough though I can simply employ a human to download it.

  • Thanks for the advice. It's not secret nuclear formulas or anything just images that I don't want people hot-linking too or scraping and causing me to pay more bandwidth costs. – user3953989 Aug 1 '17 at 20:29

You could require authentication from your CDN (depending on your CDN's capabilities). The website can use (public) credentials with the CDN so your visitors can see the images, but any external requests will get denied from the CDN. It doesn't prevent a visitor to your site from copying the image or the credentials though, and people could use the same credentials from outside your site, but crawlers won't be that smart, and neither will most users, so it may be sufficient for your needs.

You could alternatively inspect the referer header at your CDN to only allow your website, but this has the same downsides as above--referer header can be spoofed.

If you really wanted to lock it down, you would grant single-use tokens to load each image. But once you've shown the image to any user, you can't prevent the user from copying the image or taking a screenshot and uploading elsewhere. You may consider adding watermarks to your images.

  • I like this suggestion! The more difficult for abusers the better. – user3953989 Aug 1 '17 at 20:51

Having users log in to access private content is the only true way to prevent scrapers. There is an ongoing legal case over the use of scraping public LinkedIn data, so until that is resolved scraping will remain legal. Also, make sure you have your robots.txt file configured correctly, though this will only stop bots that respect the file.

As for hotlinking setup Google Analytics and monitor where your traffic is coming from. Hopefully, your CDN also provides basic analytics for this and make sure you are using a CDN that supports access tokens to secure the content. Still, I would be more concerned with people downloading the private content and rehosting it.

  • Google Analytics is a JavaScript-based client-side solution and will therefore not see any requests from hotlinks to images or from scrapers: images don't support JavaScript, scrapers might ignore it. – amon Aug 2 '17 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.