Add hotlink protection to prevent unauthorized quota consumption
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 42/100
Línea de trabajo
Comienza por localizar el punto de entrada de la configuración del dashboard y la solicitud CDN o configuración edge descrita en el issue; no se mencionan archivos ni tests en el payload. Define cómo se gestionan los dominios permitidos y los referrers vacíos, y después verifica el comportamiento de bloqueo y las analíticas opcionales de top-referrer según los criterios de aceptación.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Impact: 90 · Confidence: 100 · Complexity: 75
Description
-
Problem: Optimole charges based on the number of unique visits hitting the CDN. However, there is no way for users to restrict which domains can serve their optimized images. If a third party hotlinks an image directly using the CDN URL, that external traffic counts against the user's monthly quota, resulting in unwanted and potentially expensive automatic plan upgrades. Additionally, users are completely blind to this because the dashboard does not provide domain/referrer analytics to debug traffic spikes.
-
Desired Behavior: Implement a Hotlink Protection feature that allows users to whitelist authorized referring domains. Any CDN requests originating from unauthorized referrers should be blocked. Additionally, providing basic visibility into top referring domains in the dashboard would help users identify abuse.
-
Acceptance Criteria:
- Add a 'Hotlink Protection' settings section in the dashboard to define allowed domains.
- Configure CDN edge rules to block requests (return 403 Forbidden or a placeholder frame/image) when the HTTP Referer does not match the allowed list.
- Ensure legitimate empty referrers (direct access) can be optionally permitted or blocked.
- (Bonus/Secondary) Expose top referrers in the analytics dashboard to help users track down traffic anomalies.
Customer Context
A customer on a 120k monthly visit plan was auto-upgraded after their Optimole usage spiked to 320k visits, despite their website traffic remaining flat. They are threatening to migrate to a competitor because they cannot see where the traffic is coming from (missing domain/referrer analytics) and cannot stop third-party sites from draining their quota (missing hotlink protection).
Root Cause Analysis
The root cause is a billing and trust gap: the customer is being charged for usage they cannot independently audit or control. Because Optimole handles image requests via its own CDN, the user's host access logs will not reflect hotlinked CDN hits. Without hotlink protection or domain-level traffic reporting on Optimole's end, the customer is left paying for potentially abusive third-party traffic with no tools to mitigate it.
Reasoning
The customer is complaining about unexpected traffic spikes causing automated billing upgrades, requesting hotlink protection and detailed usage reporting (referrers/domains) to audit and control the usage. Currently, Optimole does not offer hotlink protection or granular analytics, meaning users have no way to verify if CDN traffic is legitimate or block unauthorized domains from consuming their quota. A search of documentation and GitHub issues reveals no existing capabilities or tickets for this.
Source: HelpScout #3349505247
Generated by feature-request-triage workflow (ID: feature-request-triage_6a2ab1f7befe28.49171116)
- Lenguaje dominante
- PHP
- Estrellas
- 73
- Forks
- 14
- Merge medio
- 2 d 12 h
- PR fusionados (30 d)
- 18
Preparar el entorno
- Incluye un Dockerfile o un archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de Codeinwp/optimole-wp
-
bug-report bug-report-triage crash-report regression
Dificultad 4/5 3-5 días Aptitud para principiantes 45/100
Codeinwp/optimole-wp#1163 ·
Los mantenedores suelen responder en 1 día
-
bug-report bug-report-triage crash-report
Dificultad 4/5 3-5 días Aptitud para principiantes 65/100
Codeinwp/optimole-wp#1162 ·
Los mantenedores suelen responder en 1 día
-
customer report feature-request-triage
Dificultad 3/5 1-2 días Aptitud para principiantes 65/100
Codeinwp/optimole-wp#1161 ·
Los mantenedores suelen responder en 1 día
-
bug-report bug-report-triage customer report regression
Dificultad 4/5 3-5 días Aptitud para principiantes 56/100
Codeinwp/optimole-wp#1159 ·
Los mantenedores suelen responder en 1 día
-
customer report feature-request-triage
Dificultad 3/5 1-2 días Aptitud para principiantes 55/100
Codeinwp/optimole-wp#1151 ·
Los mantenedores suelen responder en 1 día
Todos los issues de Codeinwp/optimole-wp
Issues similares
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
rap2hpoutre/fast-excel#425 ·
-
bug Medium Priority
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
Los mantenedores suelen responder en 1 día
-
sync-en
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
Los mantenedores suelen responder en 1 día
-
sync-en
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
Los mantenedores suelen responder en 2 días
-
Перевод устарел
Dificultad 1/5 1-3 horas Aptitud para principiantes 78/100