Preventing Amazon Cloudfront hotlinking

Question

I use Amazon Cloudfront to host all my site\'s images and videos, to serve them faster to my users which are pretty scattered across the globe. I also apply pretty aggressi

Answer 1

As far as I know, there is currently no solution, but I have a few possibly relevant, possibly irrelevant suggestions...

First: Numerous people have asked this on the Cloudfront support forums. See here and here, for example.

Clearly AWS benefits from hotlinking: the more hits, the more they charge us for! I think we (Cloudfront users) need to start some sort of heavily orchestrated campaign to get them to offer referer checking as a feature.

Another temporary solution I've thought of is changing the CNAME I use to send traffic to cloudfront/s3. So let's say you currently send all your images to:

cdn.blahblahblah.com (which redirects to some cloudfront/s3 bucket)

You could change it to cdn2.blahblahblah.com and delete the DNS entry for cdn.blahblahblah.com

As a DNS change, that would knock out all the people currently hotlinking before their traffic got anywhere near your server: the DNS entry would simply fail to look up. You'd have to keep changing the cdn CNAME to make this effective (say once a month?), but it would work.

It's actually a bigger problem than it seems because it means people can scrape entire copies of your website's pages (including the images) much more easily - so it's not just the images you lose and not just that you're paying to serve those images. Search engines sometimes conclude your pages are the copies and the copies are the originals... and bang goes your traffic.

I am thinking of abandoning Cloudfront in favor of a strategically positioned, super-fast dedicated server (serving all content to the entire world from one place) to give me much more control over such things.

Anyway, I hope someone else has a better answer!