---
title: Exempt partners from Hotlink Protection · Cloudflare Web Application Firewall (WAF) docs
description: When enabled, Cloudflare Hotlink Protection blocks all HTTP referrers that are not part of your domain or zone. That presents a problem if you allow partners to use inline links to your assets.
lastUpdated: 2025-01-17T12:22:49.000Z
source_url:
  html: https://hyperlint-automation-repository-scan-0098fc0.preview.developers.cloudflare.com/waf/custom-rules/use-cases/exempt-partners-hotlink-protection/index.md
  md: https://hyperlint-automation-repository-scan-0098fc0.preview.developers.cloudflare.com/waf/custom-rules/use-cases/exempt-partners-hotlink-protection/
---

When enabled, [Cloudflare Hotlink Protection](https://developers.cloudflare.com/waf/tools/scrape-shield/hotlink-protection/) blocks all HTTP referrers that are not part of your domain or zone. That presents a problem if you allow partners to use inline links to your assets.

## Allow requests from partners using custom rules

You can use custom rules to protect against hotlinking while allowing inline links from your partners. In this case, you will need to disable [Hotlink Protection](https://developers.cloudflare.com/waf/tools/scrape-shield/hotlink-protection/) within the **Scrape Shield** app so that partner referrals are not blocked by that feature.

This example uses the [`http.referer`](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.referer/) field to target HTTP referrals from partner sites.

The `not` operator matches HTTP referrals that are not from partner sites, and the action blocks them:

* **Expression**: `not (http.referer contains "example.com" or http.referer eq "www.example.net" or http.referer eq "www.cloudflare.com")`
* **Action**: *Block*

## Allow requests from partners using Configuration Rules

Alternatively, you can create a [configuration rule](https://developers.cloudflare.com/rules/configuration-rules/) to exclude HTTP referrals from partner sites from Hotlink Protection. In this case, you would keep the Hotlink Protection feature enabled.
