Configure Windows Plesk Hotlink Protection with Clear Limits

Hotlink protection limits other websites embedding selected files from your site. It is a bandwidth-control feature, not a private-download authentication system: HTTP referrer information can be absent or forged, and cached copies may remain available elsewhere.

Enable protection for the intended Windows website

1. Sign in to the trusted Plesk panel and select the domain under Websites & Domains.
2. Open Hotlink Protection if the host and Windows installation expose it. The interface illustrated in the old article is historical.
3. Use Switch On, choose only the required protected file extensions, and enter them in the format described by that interface, historically separated by spaces.
4. Add legitimate embedding sites under Addresses of friendly websites, then save.

Include your actual frontend/CDN domains where needed. Do not add every CSS or JavaScript extension blindly: cross-domain assets, previews and integrations may depend on them.

Test both allowed and denied use

Check normal pages, approved embeds and an unapproved embedding page using representative files. Inspect the actual network response, not just a cached browser image. Consider clients that omit referrer information and the behavior of any CDN or reverse proxy. This feature does not remove content already copied to someone else’s server.

Remove an exception versus disable protection

Deleting a friendly website from the allowlist removes that website’s exception; it does not disable hotlink protection. The previous article incorrectly described that action as switching the feature off. To disable the gate, use the feature’s explicit off/disable control where available and save. If the current host-customized interface differs, confirm the control with the administrator before changing the allowlist.

For confidential material, use authenticated access with deliberate cache behavior rather than relying on referrer-based rules. Hotlinking is not inherently unauthorized: syndication and your own cross-domain media delivery can be intentional.

Reference: Plesk’s historical Windows hotlink-protection workflow. Check installed-version documentation before applying it.

Reviewed October 15, 2026. Documentation review; no Windows/IIS rule, allowlist or customer website was changed or tested.