The ability of any to spoof any aspects of what is logged is immense. Not sure what would be the best way forward. Are you adverse to hotlinking, just asking. As for unauthorized use, that's near impossible (and expensive) to address.

Chuckles are most thefts are done at the website, right click level ... and even if you defeat that with scripting, you can't prevent it from "no style" viewers, etc.

I'd watermark everything, clearly, and offer a password portal on site for those willing to pay the freight to get an unmarked images (or lightly marked) for authorized use.

Well aware that ugly images just look ugly, but trying to be nice and keeping control of your images are diametrically opposed in this "if its on the web it's free" bunch of users. Bots just steal stuff, you deal with those in a different method.

What I have done over the years is offer an image that is "just large enough" for most devices and processed so that it will scale "larger" without going too wonky. Site needs are addressed, load speeds are increased, and if stolen is not that useful to the bad actor.

The simplest criterion is “request has a referer, but the referer is something other than your site”. In addition, you need to exclude all the standard search engines--assuming your images are indexed and searchable.

Mechanics obviously depend on server type. One approach is to set an environmental variable, and then run the watermarking script* if the variable is present.

Why are you letting them see your images at all? Just to allow for false positives, where you thought something was a hotlink but it’s really a legitimate human? I just put up a hideous NO HOTLINKS image. (It has to be horrible to look at, so the hotlinking site owner will be impelled to get rid of the link quickly--and humans with functioning eyeballs will learn to avoid the offending site.)


* Some years back, there was a simple php function posted on this site that takes images and applies a transparent overlay containing the watermark. I think I’ve still got it somewhere. The main drawback is that the result comes through as png, which can be a filesize issue if your images started out as full-color jpgs.

@Lucy the mechanics of the conditional watermark will be handle at the app level in Python. It is for all intents and purposes already written. The images in question are graphs that are generated with SVG.

Why are you letting them see your images at all?

My understanding is that effectively blocking hotlinking is nearly impossibles. Apply rules too strictly, and you could be blocking legitimate users and/or search engines from accessing the images. Not strict enough will allow the malicious hotlinkers the ability to side step your measures, thus causing annoyance for legitimate users and doing nothing for those that you would want to block. I figured that by conditionally watermarking the image, at worst a false positive will show the image with large watermark, instead of no-image.

But as I am typing this, I am now realizing that I have another issue to worry about, that is Cloudflare. I am using Cloudflare for image caching, so the cached image should shown. Thus my dynamic script will change nothing as the image will be served from the cache and not my server. Then I might need to use a worker to redirect the request.

"Well, Jane, it just goes to show you, it's always something — if it ain't one thing, it's another."
— Roseanne Roseannadanna

A portion of my graphs are inter-active in that they include animation and thus can not be included on the pages within an <img> tag. Instead I include them in <object> tags. The <object> tag allows for a fallback src, for which I use the exact same url as the object. When browser don't support the <object> or animation the SVG object is displayed as an image. Obviously there is no animation or inter-activity but the graph still appears, this is a sort of progressive degradation.

I just noticed that the fallback images are appearing in Google image search. This implementation is relatively new for me, so I am only starting to see a very few images appear in image search. Previously, when I have implemented the <object> tag without the fallback the SVG's were ignored. Has anyone else implemented SVG's or other formats like this? Will the malicious hotlinkers also pick these images up?