List every legitimate hostname that embeds your files, including www, subdomains, a shop frontend and any required preview or CDN domain. Record the current settings before changing them, because disabling the feature can clear its allowlist.

1. Open Hotlink Protection in cPanel and enable the feature when appropriate.
2. Review the allowed URLs and include the legitimate website variants. A missing secure or alternate hostname can cause your own pages to show broken images.
3. Select only the extensions you intend to protect. Consider feeds, newsletters and external business integrations before blocking a file type broadly.
4. Decide whether direct requests should be permitted. This affects visitors opening an image URL without an ordinary referring page, so test that use case deliberately.
5. Save the configuration, then test images from your own pages and from an unauthorised external embedding page. If using a cache or CDN, clear only the relevant cached test objects when necessary.

Your website should display its assets normally while the unwanted embedding request is restricted according to the saved rule. Test mobile and private browser sessions as referrer handling can differ.

If legitimate images fail, review allowed URLs and referrer policy rather than changing file permissions to 777. Temporarily restore the previous hotlink settings to isolate the cause. Keep a copy of the allowlist before disabling the feature for troubleshooting.

• Blocking an unwanted website visitor with cPanel IP Blocker
• Editing a text file in cPanel File Manager
• Checking whether Cloudflare is active for a hostname
• Preventing unintended directory listings in cPanel

• cPanel documentation