Hotlinking, Scraping and Bandwidth Theft: Locking Down a Tube Site

There is a moment most tube operators recognise: bandwidth doubles, revenue does not. Somewhere out there a site you have never heard of is embedding your MP4s directly, and you are paying to serve its visitors. Somewhere else a scraper is rebuilding your catalog page by page. This guide is about the three distinct thefts that hit tube sites, which defences actually stop each one, and which popular advice is theatre.

Nothing here stops a determined human with a screen recorder, and no guide should promise otherwise. The realistic goal is to make automated, at-scale copying expensive enough that it moves to an easier target — and to make sure you are not personally funding it.

Three different problems that get one name

• Hotlinking (bandwidth theft). Another site embeds your video or thumbnail URLs directly. Their visitors, your transfer bill. This is the one that shows up as a cost before it shows up as a complaint.
• Scraping (content theft). A bot walks your listings and copies titles, descriptions, tags and thumbnails to rebuild your catalog elsewhere. The damage is competitive and, because the copy often outranks a page it duplicates, it is an SEO problem too.
• Full mirroring. Someone clones the site outright, ads and all. Rarer, more damaging, and mostly a legal problem rather than a technical one.

They need different answers, which is why blanket advice like “enable hotlink protection” disappoints so many people — it addresses one third of the problem.

What hotlinking actually costs

Put a number on it before choosing a defence. A single 480p video at roughly 1 Mbps costs about 450 MB per full view. Ten thousand hotlinked views a month is around 4.5 TB — on metered bandwidth that is real money, and on an unmetered box it is the difference between a healthy server and a saturated uplink at peak. Thumbnails look trivial by comparison until you notice a scraper pulling every thumbnail in a 50,000-video catalog on a loop.

Check before you fix. Your access logs already hold the answer: group requests to media paths by Referer, and the offenders will be obvious within a minute. If the top referrers are your own domain and a couple of search engines, you do not have a hotlinking problem and can skip to the scraping section.

Referer checks: the cheap defence that half works

The standard nginx approach tests the Referer header and rejects anything that is not on your allow-list:

• It stops casual embedding immediately — the forum poster, the small aggregator, the blog that pasted your URL into a video tag. That is genuinely most of the volume.
• It is trivially forged. Any scraper worth worrying about sends whatever referer you require. Treat it as a speed bump, not a lock.
• It has to allow empty referers, or you break direct navigation, some privacy browsers and various apps. That exemption is also the hole every determined leech drives through.

Worth ten minutes of configuration. Not worth believing in.

Signed URLs: the defence that actually holds

The real fix is to stop serving media at guessable addresses. With signed (expiring) URLs, your application hands each visitor a link containing a hash of the path, an expiry timestamp and a server-side secret; the web server verifies that hash before serving a byte. nginx implements this natively through its secure-link modules, and every serious CDN offers an equivalent.

The properties that matter:

• A copied link dies on its own. Set expiry in minutes, and a URL pasted elsewhere is worthless before it can spread.
• You can bind to the visitor. Including the client IP in the hash means a link that works for one person and nobody else — excellent for premium content, slightly rough on mobile users whose IP changes mid-session.
• Nothing is forgeable without the secret. Unlike referer checks, this is cryptography rather than an honour system.
• It costs you cacheability. Per-user URLs are per-user cache keys. Tune expiry windows so a popular video still gets edge hits, and keep signing for the media plane rather than the thumbnails.

Note the interaction with delivery: if your video plane sits behind a CDN whose terms were not written for video, signing is the smaller of your two problems — see the Cloudflare guide for that split.

Slowing down scrapers

Scrapers want your metadata, and metadata is exactly what you publish for search engines. So the goal is not to block crawling — it is to make bulk copying slow and detectable while leaving Googlebot alone.

• Rate-limit by IP at the edge. Real visitors browse in bursts and pause; scrapers walk pagination at a metronomic rate. A modest per-IP request cap on listing pages costs legitimate users nothing.
• Verify the crawlers you honour. Reverse-DNS the ones claiming to be search engines rather than trusting the user-agent string. Most “Googlebot” scraper hits fail this instantly.
• Watch pagination depth. A client that requests page 400 of a category without ever loading a video page is not a person.
• Seed identifiable data. A handful of unique, harmless strings in your descriptions makes stolen catalogs searchable later. This is how you find mirrors without checking manually.
• Do not break your own SEO. Blocking on user-agent, requiring JavaScript for listings or hiding titles behind scripts hurts you far more than the scraper. The SEO guide exists because those pages are your traffic.

Watermarking: turn the leak into a channel

The most useful reframing available to a tube operator is that content leaving your site is not always a loss. If every file carries a legible domain watermark, a stolen video becomes an advertisement that someone else is paying to host — the exact mechanic behind the seeding strategy in the traffic sources guide.

Watermark for that outcome deliberately: legible on a phone, positioned to survive cropping, burnt in during your normal encoding pass rather than added later. Files you never watermarked can only be re-marked by re-encoding the whole catalog, which is why this is a policy decision to make on day one, alongside the rendition ladder in the encoding guide.

Defences, ranked by what they buy you

When technology runs out

Against a full mirror, configuration stops helping and process takes over. Find the copies — your seeded strings, reverse image search on distinctive thumbnails, and your own referer logs are the three cheap methods — then work the chain: the host, then search deindexing, then the registrar, CDN and ad networks. Deindexing is usually the blow that lands, because a clone with no search visibility has no business model. The full workflow, including what to send and in what order, is in the DMCA playbook.

One practical note: enforcement only works on content you own or license exclusively. Sponsor and feed material belongs to whoever licensed it to you, so spend your enforcement hours on exclusives — which is, incidentally, another argument for owning some.

Because TubePress is self-hosted and unencoded, all of this is yours to configure: media paths, signing, rate limits and watermark policy live in your server config and your CMS settings rather than behind a vendor’s feature tier.

You cannot lock down a platform you do not control. Download TubePress and run the whole delivery path — server, secrets and all — on hardware you own.