Use Referer hotlink protection rules to prevent malicious hotlinking of your website-ApsaraVideo VOD(VOD)-阿里云帮助中心

Referer-based hotlink protection uses the Referer field in HTTP request headers—such as a Referer whitelist or blacklist—to enforce access control. It identifies and filters visitors to prevent unauthorized use of your website resources. After you configure a Referer whitelist or blacklist, CDN checks each request against the list and either allows or denies access. If allowed, CDN returns the resource URL. If denied, CDN returns HTTP status code 403. This topic describes how to configure Referer hotlink protection.

Important

In ApsaraVideo VOD, Referer hotlink protection is disabled by default. This means any website can access your resources.
When you add a domain name like aliyundoc.com to a Referer list, CDN apply the rule to both the domain itself and all its subdomains (such as *.aliyundoc.com).
For Range requests, browsers add the Referer header on the second request. To allow these requests, add the domain to the Referer whitelist.
After enabling Referer hotlink protection in ApsaraVideo VOD, add vod.console.aliyun.com to the Referer whitelist to preview videos in the ApsaraVideo VOD console.

Anatomy of a Referer

The Referer header indicates the URL of the page where a request originated. A Referer URL consists of a scheme, domain, path, and query parameters, as shown in the following figure.

Note

The value of a Referer header is essentially a URL.
Alibaba Cloud supports domain-only Referer configurations. To enable this, select the Ignore Scheme option.

Use cases

A Referer blacklist or whitelist primarily protects your website resources from being directly linked or used by other websites. Common use cases include:

Copyright protection: For websites with copyrighted content, you can use a Referer whitelist to restrict access to authorized websites only.
Hotlinking prevention: A whitelist ensures that your resources can be accessed only from specific websites, preventing other sites from consuming your bandwidth by directly linking to your content.
Enhanced website security: By allowing only specific websites to access your resources, you can prevent malicious hotlinking, unauthorized access, and theft of sensitive information.
Traffic source control: You can restrict traffic from specific websites to control traffic sources and improve the stability and security of your website.

How it works

A Point of Presence (POP) checks the Referer header of each request. If the Referer is not on the whitelist or if it is on the blacklist, the POP denies the request. This saves bandwidth and reduces load on the origin server. CDN use the following rules to process Referer requests:

If the Referer in a request matches an entry in the blacklist or does not match any entry in the whitelist, CDN deny the request.
If the Referer in a request matches an entry in the whitelist, CDN allow the request.

Procedure

Log in to the ApsaraVideo VOD console.
In the left-side navigation pane, under Configuration Management, click CDN Configuration > Domain Names.
On the Domain Names page, find the target domain name. Click Actions, then click Configure.
In the navigation pane on the left for that domain, click Resource Access Control.
On the Referer Hotlink Protection tab, click Modify.

Select Blacklist or Whitelist as needed.

Parameter	Description
Type	Blacklist The POP denies access to requests that contain a Referer from the blacklist. Whitelist The POP allows only requests that contain a Referer from the whitelist. Note Blacklists and whitelists are mutually exclusive. You can select only one type at a time.
Rules	You can add multiple Referers. Separate each entry with a line break. You can use an asterisk () as a wildcard to match all subdomains. For example, `.example.com` matches all subdomains of `example.com`. If you do not specify a wildcard, an entry matches both the domain itself and all its subdomains. For example, an entry for `example.com` matches both `example.com` and `.example.com`. Note* The total size of all rules in a Referer list cannot exceed 60 KB. You do not need to include the scheme in the rules.
Redirect URL	If a request is blocked, the POP returns a 302 redirect with a Location response header. This parameter specifies the value for the Location header. The URL must start with `http://` or `https://`. Example: `http://www.example.com`.
Advanced
Allow resource URL access from browsers	This option is cleared by default. If you select this option, requests with an empty referer are not blocked and are allowed to access the resource, regardless of your list settings. The request does not include a Referer header. The Referer header value is empty.
Exact match	By default, this option is not selected. If selected, wildcards (*) are no longer supported for domain matching. For example, `example.com` matches only `example.com`—not its subdomains.
Ignore scheme	If the Ignore Scheme option is cleared, the Referer header must include an HTTP or HTTPS scheme. If you select the Ignore Scheme option, the Referer header is not required to include a scheme.

Click OK to complete the configuration.

Referer matching logic

The table below shows how Referer matching works. If a request does not match the whitelist—or matches the blacklist—CDN rejects the request and returns HTTP status code 403.

List configuration	Referer in request	Match result	Matching logic
www.example.com *.example.com	http://www.example.com/img.jpg	Yes	The domain in the Referer header matches an entry in the rule list.
	http://www.example.com:80/img.jpg	Yes
	www.example.com	For more information, see the description of the matching logic.	If Ignore scheme is not selected, the result is No. The Referer header lacks http:// or https://. If Ignore scheme is selected, the result is Yes.
	http://aaa.example.com	Yes	Result is Yes regardless of whether Exact match is selected.
	http://aaa.bbb.example.com	See explanation	If Exact match is not selected, the result is Yes. The rule `.example.com` matches multi-level subdomains. If Exact match* is selected, the result is No. The rule `*.example.com` matches only second-level domains—not third-level domains.
	http://example.com	No	The second-level domain in the Referer header does not match the wildcard entry. Wildcard entries do not include the second-level domain itself.
	http://www.example.net	No match	The request matches neither the whitelist nor the blacklist. By default, access is allowed.

FAQ

Why does the Referer header sometimes lack http:// or https://?

In most cases, the Referer header in a user request includes an HTTP or HTTPS scheme. However, in certain situations, the Referer may not include a scheme.

A common scenario is when a user navigates from a non-secure website (which uses HTTP) to a secure website (which uses HTTPS). Browsers may modify or remove the Referer header based on security policies, such as the Referrer-Policy, to protect user data. In this case, the Referer header might contain only the domain, without the scheme.

In addition, some browsers or proxy servers may automatically remove the Referer header in specific situations, such as when private browsing mode is used or a website is accessed through an anonymous proxy.

So in practice, handle requests where the Referer header lacks http:// or https:// to ensure correct evaluation.

Handling empty Referer

An empty Referer occurs when the Referer header is missing from an HTTP request or its value is empty. The Referer header in a request usually contains a complete URI that includes the scheme (such as http or https), a hostname, and possibly a path and query string. An empty referer can occur in the following scenarios:

Direct access: When a user enters a URL directly into the browser's address bar, uses a bookmark, or opens a link in a new blank tab, no referring page exists. Therefore, the Referer header is empty.
User privacy: A user or software used by the user, such as a browser extension or a privacy mode, may intentionally remove the Referer header to protect privacy.
Security protocol: When a user navigates from an HTTPS page to an HTTP page, the browser usually does not send the Referer header to prevent the leakage of sensitive information.
Client-side policy: Some websites or applications may control whether the Referer header is sent for security reasons by setting a <meta> tag or an HTTP header such as Referrer-Policy.
Cross-origin request: Some cross-origin requests may not include the Referer header due to browser security policies.

How you handle requests with an empty Referer depends on your specific use case and security requirements. The following are some recommendations:

Default policy: If your service does not rely on Referer information to make decisions, you can allow requests with an empty Referer.
Allow access: For specific URLs or origins, you can select the Allow resource URL access from browsers option. This allows access even if the Referer is empty. In this case, CDN and POPs grant access to the resource.

Should I use a blacklist or a whitelist to prevent hotlink abuse?

A whitelist allows only the domains in the list to access your resources and blocks all sources that are not in the list. A blacklist blocks only the domains in the list and allows sources that are not in the list.

To prevent hotlink abuse, use a blacklist (recommended): add a nonexistent domain name to the blacklist and enable the option to block requests with an empty Referer header. This blocks requests with an empty Referer header without affecting normal access.