How to Fix Cloudflare Error 1011 (Hotlink Protection)
What Error 1011 means
Cloudflare's 1xxx error family covers DNS and proxy configuration problems, and Error 1011 is the one labeled "Hotlink Protection." It appears when Cloudflare's Hotlink Protection feature blocks a request — most often an image — because the request's Referer header does not match one of the zone's allowed domains. The feature exists to stop other websites from hotlinking your images: embedding them on their own pages so your bandwidth pays for their traffic. When a request arrives without an acceptable referer, Cloudflare serves the Error 1011 page instead of the file.
The catch is that legitimate traffic can trigger it too. Privacy-focused browsers and extensions strip the Referer header from requests, so images on your own site can be blocked even for your own visitors. Direct image opens — typing or pasting an image URL into the address bar, or opening it from a search-result preview — also arrive with no referer from your domain, which is exactly the pattern the protection is designed to stop. And if the site owner recently enabled Hotlink Protection, syndicated feeds, email newsletters, RSS readers, mobile apps loading images in a webview, and social-media preview cards can all start failing at the same time, which is usually how owners first discover the setting is on.
Common causes
- Another site is hotlinking your images: the feature working as intended. Someone embeds your images on their own pages, their visitors' browsers send a referer from the other domain, and Cloudflare blocks the request with Error 1011 instead of serving your image on someone else's site.
- Privacy tools stripping the Referer header: browser extensions, ad-blocker privacy lists, VPN tracker blocking, and strict tracking-protection modes in browsers like Firefox and Brave remove the Referer header entirely. With no referer at all, even images on your own pages look like hotlink attempts and get blocked.
- Opening images directly: pasting an image URL into the address bar, or opening an image from a search preview, sends no referer from your domain. The protection treats a direct open exactly like a hotlink attempt, so Error 1011 is the expected result — not a bug.
- A legitimate domain missing from the allowed list: sites with several domains get bitten by this. The www and non-www versions, subdomains, staging domains, or a separate media domain like images.example.com can all be blocked if Hotlink Protection only recognizes the main domain. Every hostname your images are served from needs to be covered.
- Turned on once and never tested: owners enable Hotlink Protection, forget about it, and don't notice it breaks email newsletters, RSS readers, social-media preview cards, and mobile apps — anything that loads images without sending the site's referer. The first symptom is usually a complaint that images "randomly" stopped loading, days or weeks after the setting was flipped.
How to fix Error 1011 — step by step
Steps 1 through 3 are for visitors. Steps 4 through 6 are for the site owner.
- Figure out who is supposed to fix Error 1011. Error 1011 is generated by the Cloudflare settings of the website whose images are being blocked, not by your computer. If you are just browsing someone else's site, your fix options are the visitor steps below — only the site owner (or whoever manages their Cloudflare account) can change the actual setting. If you run the site or manage its DNS, skip straight to step 4.
- Visitor: reload the image from the site page, not directly. Open the image again from the website page itself — click through to the article or product page and let the image load in place — rather than pasting the image URL into the address bar or opening it from a search preview. A direct open sends no referer from the site, which is exactly what Hotlink Protection blocks. If the image loads inside the page but fails when opened directly, the protection is simply doing its job.
- Visitor: turn off privacy add-ons that strip the Referer header. Temporarily disable browser extensions and settings that hide or strip the Referer header — privacy extensions, ad-blocker privacy lists, VPN tracker blocking, and strict tracking-protection modes in browsers like Firefox and Brave. Reload the page after disabling each one to find the culprit. If the images appear, you have your answer: the tool was making your legitimate visit look like a hotlink attempt. You can then add the site to that tool's allowlist instead of disabling it everywhere.
- Site owner: find the Hotlink Protection switch in Cloudflare. Log in to the Cloudflare dashboard, select the affected domain, then go to Security, then Bots, and find the Hotlink Protection section (on older accounts it may still appear under Scrape Shield). It is a single on/off toggle — when it is on, Cloudflare blocks requests for images and other static files unless the request's Referer header matches the zone's domain. Confirm you are looking at the correct domain if your account holds several.
- Site owner: allow your other domains or turn the protection off. Decide whether you still need the protection. If you do, make sure every legitimate source of your image traffic is covered: the www and non-www versions, subdomains, staging domains, and separate media or CDN domains such as images.example.com. If legitimate traffic keeps getting blocked — email newsletters, RSS readers, mobile apps, and social preview bots all load images without your referer — the practical fix is to switch Hotlink Protection off and rely on bandwidth alerts or a firewall rule to spot real hotlinking instead.
- Site owner: clear Cloudflare's cache and re-test the images. After changing the setting, go to Caching, then Configuration in the Cloudflare dashboard and click Purge Everything — blocked Error 1011 responses can sit in the cache and keep showing for a while after the rule is fixed. Then test in a fresh private window: load a site page and confirm every image renders, open an image URL directly to see the behavior you intend, and check a newsletter or app view if that was part of the complaint.
Did this fix it? Quick checklist
- Images load normally from the site's own pages in a clean browser profile
- Hotlink Protection either covers every domain you serve images from, or it is switched off
- No legitimate traffic source (newsletters, apps, feeds) shows Error 1011 anymore
- A spot-check of bandwidth usage shows no unexplained hotlinking spikes
If you are the owner and the error persists after the setting looks right, purge the Cloudflare cache — blocked Error 1011 responses can sit in the cache and keep showing for a while after the rule itself is fixed. Also confirm the toggle is in the correct zone: accounts holding several domains often flip the switch for the wrong one. And if you use a separate media or CDN hostname, check the DNS zone that is actually active there — edits to a zone whose nameservers aren't live change nothing.
Frequently asked questions
What does Cloudflare Error 1011 mean?
Error 1011 means Hotlink Protection: Cloudflare blocked a request for an image or static file because the request's Referer header did not match the site's domain. The feature stops other websites from embedding your images on their pages and burning your bandwidth. When the referer is missing or comes from a domain that is not allowed, Cloudflare serves the Error 1011 page instead of the file.
Why does Error 1011 block images on my own site?
Because legitimate requests sometimes arrive without a usable referer. Privacy extensions and strict browser tracking protection strip the Referer header, so your own pages' images look like they came from nowhere. Direct image opens, email clients, RSS readers, mobile app webviews, and social-media preview bots all fetch images without sending your site's referer too, so the protection cannot tell them apart from genuine hotlinking.
Can I fix Error 1011 as a visitor?
Partly. Reload the image from the website's own page instead of opening the image URL directly, and temporarily disable any extension or browser setting that strips the Referer header — that resolves the visitor-side cases. If the images still fail everywhere on the site, the owner's Hotlink Protection settings are the problem and only they can change them; contact the site through their social accounts or email and mention Cloudflare Error 1011.
Is it safe to turn off Cloudflare's Hotlink Protection?
For most sites, yes. Hotlink Protection is a blunt tool — it stops casual image embedding but a determined site can still re-host your images, so it is not real copy protection. Many owners find it blocks more legitimate traffic (newsletters, apps, feeds) than it saves in bandwidth. If hotlinking costs you real money, better options are serving images through a CDN with signed URLs, watermarking, or watching bandwidth alerts and blocking offenders with a firewall rule instead.
Why does Error 1011 only appear in private or incognito mode?
Private windows usually run with stricter tracking protection that hides the Referer header, and any cached images or cookies that would mask the problem in your normal window are absent. So the same image that loads fine in your everyday browser fails in incognito because Hotlink Protection sees a request with no referer. This is actually a useful diagnostic: if incognito fails but the normal window works, a stripped Referer is almost certainly the cause.