Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Add hotlink protection to prevent unauthorized quota consumption

オープン
  • 何か問題がありますか？
#1,076 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
42/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
静か
技術スタック
php
領域
backend, cloud

調査の方向性

まず、dashboard 設定のエントリポイントと、issue に記載された CDN リクエストまたは edge 設定を見つけます。payload にはファイルやテストの指定はありません。許可されたドメインと空の referrer をどのように扱うかを定義し、その後、受け入れ条件に照らしてブロック動作とオプションの top-referrer analytics を検証します。

索引モデルが issue の本文から書いたものです。

説明

customer report feature-request-triage

Impact: 90 · Confidence: 100 · Complexity: 75

Description

  1. Problem: Optimole charges based on the number of unique visits hitting the CDN. However, there is no way for users to restrict which domains can serve their optimized images. If a third party hotlinks an image directly using the CDN URL, that external traffic counts against the user's monthly quota, resulting in unwanted and potentially expensive automatic plan upgrades. Additionally, users are completely blind to this because the dashboard does not provide domain/referrer analytics to debug traffic spikes.

  2. Desired Behavior: Implement a Hotlink Protection feature that allows users to whitelist authorized referring domains. Any CDN requests originating from unauthorized referrers should be blocked. Additionally, providing basic visibility into top referring domains in the dashboard would help users identify abuse.

  3. Acceptance Criteria:

  • Add a 'Hotlink Protection' settings section in the dashboard to define allowed domains.
  • Configure CDN edge rules to block requests (return 403 Forbidden or a placeholder frame/image) when the HTTP Referer does not match the allowed list.
  • Ensure legitimate empty referrers (direct access) can be optionally permitted or blocked.
  • (Bonus/Secondary) Expose top referrers in the analytics dashboard to help users track down traffic anomalies.

Customer Context

A customer on a 120k monthly visit plan was auto-upgraded after their Optimole usage spiked to 320k visits, despite their website traffic remaining flat. They are threatening to migrate to a competitor because they cannot see where the traffic is coming from (missing domain/referrer analytics) and cannot stop third-party sites from draining their quota (missing hotlink protection).

Root Cause Analysis

The root cause is a billing and trust gap: the customer is being charged for usage they cannot independently audit or control. Because Optimole handles image requests via its own CDN, the user's host access logs will not reflect hotlinked CDN hits. Without hotlink protection or domain-level traffic reporting on Optimole's end, the customer is left paying for potentially abusive third-party traffic with no tools to mitigate it.

Reasoning

The customer is complaining about unexpected traffic spikes causing automated billing upgrades, requesting hotlink protection and detailed usage reporting (referrers/domains) to audit and control the usage. Currently, Optimole does not offer hotlink protection or granular analytics, meaning users have no way to verify if CDN traffic is legitimate or block unauthorized domains from consuming their quota. A search of documentation and GitHub issues reveals no existing capabilities or tickets for this.

Source: HelpScout #3349505247
Generated by feature-request-triage workflow (ID: feature-request-triage_6a2ab1f7befe28.49171116)

主要言語
PHP
スター
73
フォーク
14
平均マージ
2日 12時間
マージ済み PR（30日）
18

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

Codeinwp/optimole-wp のほかの issue

Codeinwp/optimole-wp の issue をすべて見る

似ている issue

PHP の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。