Hotlinked images: pictures loaded from another site's server

What hotlinking is

Hotlinking is loading an image from another site’s server instead of your own: a logo from upload.wikimedia.org, a picture copied by URL from a supplier’s or a news site’s CDN. It looks like it works until it does not.

• Reliability. The image breaks when the other site moves it, renames it, rate-limits it or blocks foreign referrers, which many sites do with a placeholder or a 403.
• Performance. A page that loads nothing else from that host pays a DNS lookup, a TLS handshake and a connection for one picture, with no control over caching or format.
• Licensing. It uses someone else’s bandwidth and, often, their copyrighted image.

What squirrel checks

The rule runs on every crawled page and makes no network request: it reads the image URLs already in the markup. It looks at <img> (src, a lazy-loader’s data-src or data-lazy-src, and srcset), <picture> <source> elements and background declarations in inline style attributes, and ignores anything inside <noscript>.

An image host is not a hotlink when it is:

• first-party: the page’s host, a subdomain of it, or any host on the same registrable domain, so cdn.example.com is fine for example.com;
• on the built-in list of image CDNs, site-builder CDNs and object or app storage, matched on the host or its subdomains: Cloudinary, Imgix, Cloudflare Images, CloudFront, ImageKit, cdn.shopify.com, WordPress.com’s image hosts (wp.com), Squarespace and Wix CDNs, Contentful and Sanity asset hosts, Storyblok, Prismic, Webflow’s asset host (website-files.com), Bunny, KeyCDN, Fastly, Akamai, Azure and Amazon S3 storage, Google Cloud Storage, Cloudflare R2, DigitalOcean Spaces, Supabase, Vercel, Heroku, Render, Railway, Convex, Framer, jsDelivr, Unsplash, Pexels, gstatic.com, raw.githubusercontent.com and the large social and Google image hosts. The list names CDNs, not whole platforms: another tenant’s site on webflow.io, wordpress.com, myshopify.com or squarespace.com is a hotlink;
• a launch directory, review or award site that hands out embeddable badges (Product Hunt, Trendshift, DMCA.com, Capterra and similar), or any image whose path or alt names a badge, widget, seal, “featured” or “launch” badge. Those are served live by the other site by design;
• a host the page also loads a script or stylesheet from, or preconnects, dns-prefetches or preloads (an exact host match, read from the whole document, <noscript> included). This is a signal that the page connects to the host, not a test that the site owns it;
• listed in the allowed_hosts option.

Skipped altogether: tracking pixels (an image declared 1x1 or smaller, one hidden with display:none, a known analytics or advertising host, or a platform’s pixel path such as facebook.com/tr or pinterest.com/ct), avatar services (Gravatar, Libravatar, ui-avatars.com, avatars.githubusercontent.com, Unavatar, icon.horse), data: and blob: URLs, and any page served from localhost or a loopback address. A relative URL belongs to the page’s own host, or resolves against <base href> when the page sets one. A lazy-loaded image is read from data-src before its placeholder src.

It emits these checks, all info: the rule never lowers the score.

• hotlinked-images is info when a content image’s host is none of the above. Message: Content image(s) load from other sites' servers. There is one item per host, such as upload.wikimedia.org, labelled with how many images on the page load from it, up to ten hosts with a count of the rest. The message carries no host or count, so the same defect has one identity on every page, and a report can group the pages affected by each host. It passes with No content images are loaded from other sites' servers when the page has content images and none is hotlinked, and is info with No content images found when it has none.
• hotlinked-share-image is info when the og:image or twitter:image is on a host that would be reported above. Social platforms fetch those, so a hotlinked share image that breaks fails silently. Turn it off with check_social_images = false.

Why info: on a sample of stored crawls, most pages a warning would have flagged loaded a launch or directory badge, or an image from the site’s own infrastructure host that no list could know. The lists and the badge test remove the common ones; the rest is a prompt to look, not a defect.

How to fix it

If it is a picture you are licensed to use, download it and serve it from your own domain or image CDN:

<!-- before -->
<img src="https://upload.wikimedia.org/wikipedia/commons/a/ab/Logo.png" alt="Acme logo">

<!-- after -->
<img src="/images/acme-logo.png" alt="Acme logo" width="120" height="40">

If it is a badge, widget or seal the other site keeps up to date (a launch-directory badge, a review score), embedding it from their server is how it is meant to work: leave it. If the host is your own CDN, or a partner you control the arrangement with, add it to allowed_hosts.

Options

Configuration example

[rule_options."images/hotlinked"]
allowed_hosts = ["media.partner.example", "assets.mycdn.example"]
check_social_images = true

Enable / disable

Disable this rule

[rules]
disable = ["images/hotlinked"]

Disable all Images rules

[rules]
disable = ["images/*"]

Enable only this rule

[rules]
enable = ["images/hotlinked"]

enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.

Related rules

• images/optimized: which image CDNs the site uses and which formats it serves.
• images/responsive-size: small images that serve large files (it skips third-party hosts).
• images/broken-images: image URLs that are empty or placeholders.
• social/og-image-size: the share image’s size.

Images findings ship in every audit next to the SEO, performance and agent experience rules. See Fix SEO issues with AI for how an agent works through a report.

References

• Image SEO best practices, Google Search Central

Check your site

Run squirrel audit https://example.com and open the Images section of the report. Each hotlinked host is listed with the pages that load from it. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.