Would you like to learn how to deny direct access to images on the IIS server? In this tutorial, we are going to configure the IIS server to prevent direct access to images on your website.

• Windows 2012 R2
• Windows 2016
• Windows 2019

In our example, the IIS server is hosting the website WWW.GAMEKING.TIPS.

Equipment list

The following section presents the list of equipment used to create this tutorial.

As an Amazon Associate, I earn from qualifying purchases.

Tutorial IIS – Blocking direct access to image

Access the URL REWRITE website and download the installation package.

IIS URL REWRITE DOWNLOAD

Perform the URL REWRITE installation.

URL REWRITE INSTALLATION

Start the application named: IIS Manager.

Start IIS Windows

On the IIS Manager application, select your website.

On the right part of the screen, access the option named: URL Rewrite.

IIS - URL REWRITE - WEBSITE

On the top right part of the screen, click on the Add Rule option.

IIS URL REWRITE - ADD

On the inbound rules, create a new blank rule.

URL REWRITE BLANK RULE

To prevent direct access to images, use the following configuration:

Copy to Clipboard

Here is our configuration.

IIS - prevent Hotlinking

On the Conditions area, click on the Add button and use the following configuration:

Copy to Clipboard

Change the pattern configuration to your website.

Click on the OK button.

IIS - Hotlinking prevention

As an example, here is our conditions summary.

IIS - prevent image direct access

On the Action area, configure a custom error to forbid the request.

Copy to Clipboard

On the top-right part of the screen, click on the Apply option

IIS - Deny hotlinking

In our example, the IIS server will forbid direct access to images on our website.

From a remote computer, open the browser and try to perform direct access to an image.

In our example, the following URL was entered in the Browser:

• http://www.gameking.tips/test1.jpg

The IIS server will deny access and display an error message.

IIS - Deny image direct access
Try to access the website URL and all images will be displayed.
Apache - Block image direct access
From a remote Linux computer, try to perform direct access to an image.
Copy to Clipboard

Here is the command output.

Copy to Clipboard

Congratulation! You configured the IIS server to deny direct access to images.