IP Blocker, Hotlink Protection and Indexes: know what each protects

These tools address different access patterns. IP Blocker restricts selected sources; Hotlink Protection controls supported external embedding; Indexes controls directory listings when no index page is served. None establishes who may use a CMS account.

Apply the control that matches the problem

1. For repeated unwanted traffic, identify the actual client address with support, especially behind a CDN or proxy. Avoid blocking a shared office or mobile network accidentally.
2. For unwanted image embedding, configure allowed website references and test your own domains, previews and legitimate delivery networks.
3. For directory listings, select No Indexing where appropriate and check a known empty directory in a private test area.
4. Record the prior settings and verify both the intended restriction and normal customer access.

Understand the limits

A disabled directory listing does not make a known file URL private. Backups and credentials should never be in public folders. Referer-based hotlink checks can be absent or forged, so they are not suitable protection for paid or confidential downloads.

Avoid broad IP blocks as a primary defence against credential attacks. Use proper authentication, rate limiting, patching and provider-level protection. If a change locks out legitimate traffic, restore the recorded settings and review a narrower rule with support.