Back to Checks
cloudflare

Hotlink Protection is enabled

zone_hotlink_protection_enabled
Service: zoneSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Hotlink Protection (Scrape Shield) configuration by checking if it is enabled to prevent other websites from directly linking to images and media, consuming bandwidth without authorization.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Hotlink Protection, external websites can embed your media directly.

  • Confidentiality: content may be used without proper attribution or permission
  • Integrity: unauthorized use of media may misrepresent your brand
  • Availability: bandwidth theft increases costs and may degrade performance

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_hotlink_protection_enabled

Recommendation

Enable Hotlink Protection to prevent unauthorized embedding of your media.

  • Blocks requests to images when HTTP referer does not match your domain
  • Reduces bandwidth costs from unauthorized embedding
  • Review allowed referrers for legitimate integrations
  • Part of the Scrape Shield feature set for comprehensive protection

Remediation

Terraform

# Enable Hotlink Protection to prevent bandwidth theft
resource "cloudflare_zone_settings_override" "hotlink_protection" {
  zone_id = "<ZONE_ID>"
  settings {
    hotlink_protection = "on" # Blocks unauthorized embedding of your media resources
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Scrape Shield (or Security > Settings in newer UI)
3Scroll to Hotlink Protection
4Toggle the setting to On
5Review allowed referrers if legitimate integrations require access

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_hotlink_protection_enabled(Check):
    """Ensure that Hotlink Protection is enabled for Cloudflare zones.

    Hotlink Protection is part of Cloudflare's Scrape Shield suite that prevents
    other websites from directly linking to images, videos, and other media files,
    which consumes bandwidth without authorization. It blocks requests where the
    HTTP referer does not match your domain.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Hotlink Protection enabled check.

        Iterates through all Cloudflare zones and verifies that Hotlink Protection
        is enabled. This feature prevents bandwidth theft by blocking unauthorized
        embedding of your media on external sites.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Hotlink
            Protection is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            hotlink_protection = (zone.settings.hotlink_protection or "").lower()
            if hotlink_protection == "on":
                report.status = "PASS"
                report.status_extended = (
                    f"Hotlink Protection is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Hotlink Protection is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References