Prevent Image Hotlinking (IIS)

Prevent other sites from using your images as their own. This rule examines the HTTP_REFERER value for the image request and redirects, or rejects, those that don’t originate from the specified domain.

Redirect Hotlinking Requests To A Specific Image

To prevent other sites from leveraging your images without permission add the following to your web.config’s <rules> section:

<system.webServer>
	<rewrite>
		<rules>
			<rule name="Prevent image hotlinking">
				<match url=".*\.(gif|jpg|png)$"/>
				<conditions>
					<add input="{HTTP_REFERER}" pattern="^$" negate="true" />
					<add input="{HTTP_REFERER}" pattern="^https?://(www\.)?example\.com/.*$" negate="true" />
				</conditions>
				<action type="Rewrite" url="/images/no-hotlinking.png" />
			</rule>
		</rules>
	</rewrite>
</system.webServer>

This would cause all requests to images that do not originate from your site , which is to say any request that is not one of your pages loading your images, to instead return /images/no-hotlinking.png, an image you can create with harsh messaging to the degree which you desire.

Return 403 for Hotlinking Requests

Instead of rewriting these undesirable requests to a single image, as described above, you may instead choose to return a 403 Forbidden response code when images are being used without your permission. To do so, add the following to your web.config’s <rules> section:

<system.webServer>
	<rewrite>
		<rules>
			<rule name="Prevent image hotlinking">
				<match url=".*\.(gif|jpg|png)$"/>
				<conditions>
					<add input="{HTTP_REFERER}" pattern="^$" negate="true" />
					<add input="{HTTP_REFERER}" pattern="^https?://(www\.)?example\.com/.*$" negate="true" />
				</conditions>
				<action type="CustomResponse" statusCode="403" statusReason="Forbidden" />
			</rule>
		</rules>
	</rewrite>
</system.webServer>

This causes all unauthorized requests to images, which is to say any request that is not one of your pages loading your images, to instead return a 403 Forbidden response. This is typically the preferred approach, as using the first method above still consumes some of your bandwidth to deliver an image, while the second method does not.