Check ID: zone_hotlink_protection_enabled
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Hotlink Protection (Scrape Shield) configuration by checking if it is enabled to prevent other websites from directly linking to images and media, consuming bandwidth without authorization.

​
Risk

Without Hotlink Protection, external websites can embed your media directly.
  • Confidentiality: content may be used without proper attribution or permission
  • Integrity: unauthorized use of media may misrepresent your brand
  • Availability: bandwidth theft increases costs and may degrade performance

​
Recommendation

Enable Hotlink Protection to prevent unauthorized embedding of your media.
  • Blocks requests to images when HTTP referer does not match your domain
  • Reduces bandwidth costs from unauthorized embedding
  • Review allowed referrers for legitimate integrations
  • Part of the Scrape Shield feature set for comprehensive protection

​
Remediation

# Enable Hotlink Protection to prevent bandwidth theft
resource "cloudflare_zone_settings_override" "hotlink_protection" {
  zone_id = "<ZONE_ID>"
  settings {
    hotlink_protection = "on" # Blocks unauthorized embedding of your media resources
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_hotlink_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks