Your images are some of the most expensive bytes your site sends, and not everybody fetching them is somebody you built the site for. Some are other websites that dropped your URL into an <img> tag and let you pay for the bandwidth. Some are crawlers copying your catalogue into a training set. Some are scrapers walking every product page you have.

Starting today, you can turn them away. Bot & Hotlink Shield is a new tab in the console, available on the Indie Developer plan and above. It applies to your whole account in one place: every hostname and every image, with no per-key setup.

Keep your images on your own pages

List the sites that may embed your images: example.com, or *.example.com to cover every subdomain. When another site puts one of your images on its page, its visitors' browsers name that site in the Referer header, and the edge refuses the request. The page author cannot stop their visitors' browsers from sending it, so it works where hotlinking actually happens.

Some browsers send no referrer at all, because the page they came from asked them not to. By default those requests still get their images. If you would rather refuse them as well, turn on strict mode.

Decide where your images go in AI

AI crawlers get a switch of their own. GPTBot, ClaudeBot, CCBot, Bytespider, PerplexityBot and the rest collect images for training sets and AI answers. Some businesses want no part of that, and others want their products showing up when somebody asks an assistant. Either way, it's your call. Block them with one click, or leave them welcome while you keep everything else locked down.

Turn away scrapers

A second switch blocks a list we maintain for you:

  • SEO and data-mining bots that crawl hard and send nobody back to you.
  • Scraping tools and bare HTTP libraries: headless browsers, python-requests, curl, wget, the usual equipment for copying a site wholesale.

Something specific bothering you? Add your own User-Agent patterns, and they are refused alongside ours.

Without falling out of search

Blocking bots is easy. Blocking them without losing traffic takes more care. Google Images, Bing and the others fetch your pictures without a referrer, so a careless hotlink rule quietly takes you out of image search. The same goes for the link previews Slack, LinkedIn, WhatsApp and the rest draw when somebody shares your page.

So they are let through by default, ahead of every other rule, strict mode included. You keep the discovery and lose the freeloaders. If you really do want to be invisible, there is a switch for that too.

Two things are never caught by the shield. Your own mobile app loads its images the way a browser would and is not on the list. Your own servers, calling with an API key in the Authorization header, are not either: the shield is for traffic you did not invite, not for you.

Refused cheaply, and on your terms

The shield runs at the edge before the cache and before your origin is contacted. A refused scraper never becomes a fetch from your server.

You choose what a refused request gets back:

  • A plain 403. The image simply does not load.
  • A neutral placeholder. The page that borrowed your image shows a grey box instead of a broken-image icon, which is tidier for their visitors and makes the point just as clearly.

Every refusal is written to your request log with the reason and the site or client that caused it. You can see who was trying, not just that something was blocked.

What it is not

We would rather be straight about this than have you find out later. Both the referrer and the User-Agent are written by the client. The shield stops the traffic that tells the truth about itself: other websites' visitors, honest crawlers, off-the-shelf tools. In practice that is most of the unwanted traffic. It does not stop somebody who sets out to impersonate a browser. We wrote about why in Referer is not a lock.

For images that must only reach people you have authorised, use signed URLs, which are already part of every plan. The shield keeps your bill and your catalogue your own, and signatures keep private things private. Most accounts will want both.

Getting started

Open the console, choose Bot & Hotlink Shield, list your sites, and save. AI crawler blocking, bot blocking and the search-engine exception are already on. Changes reach the edge within about a minute, and nothing about your image URLs changes.