There’s no way to fully stop someone determined to steal an image from your site. That was true when this post was first written, and it’s still true now. What’s changed is which defenses actually do something and which ones just feel like they do, and the scale of the problem itself: a growing share of image theft today isn’t a person right-clicking your photo, it’s automated scraping feeding AI models and content farms, which makes some of the old advice even less relevant than it used to be.
Why Disabling Right-Click Doesn’t Stop Image Theft
This used to be the most common advice for protecting images, and it’s still floating around plugins and tutorials today. The problem is simple: it doesn’t stop anything a screenshot can’t get around in five seconds. Disabling right-click blocks one specific save method while leaving every other way to grab an image completely open, screenshots, browser dev tools, view-source, mobile long-press. It’s friction for the most casual, least motivated person, not a real barrier for anyone who actually wants your image.
Where it does have a small effect: a screenshot captures a lower-resolution version than the original file, so it discourages reuse of anything where full quality matters, print use, high-res reposting. That’s a minor side benefit, not a security measure, and it’s not worth building a strategy around.
Hotlink Protection: The .htaccess and Cloudflare Fix That Actually Works
This part of the original advice was correct then and still is now. Hotlinking is when another site embeds your image directly by linking to your file, which means every time their page loads, your server pays the bandwidth cost for their traffic, the same problem covered from the bandwidth side in how bandwidth theft actually works. The .htaccess fix still works exactly the same way:
RewriteEngine onRewriteCond %{HTTP_REFERER} !^$RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain.com [NC]RewriteRule \.(gif|jpg|jpeg|png|webp)$ - [F,L]
The [F,L] flags return a forbidden response instead of serving the image at all, cleaner than redirecting to a replacement image, which just shifts the bandwidth cost to whatever you’re redirecting to instead. If you’re already running Cloudflare, the same protection is available as a toggle in its dashboard, no .htaccess editing required, which is the easier path if you’re not comfortable hand-editing server config.
Blocking AI Image Scrapers With robots.txt
This is the part of image theft the original advice never had to think about. A growing share of image scraping today isn’t a person saving a file, it’s automated bots pulling images to train AI models, and robots.txt is the standard way to signal you don’t want that.
User-agent: GPTBotDisallow: /User-agent: Google-ExtendedDisallow: /User-agent: ClaudeBotDisallow: /
Blocking Google-Extended specifically controls AI training use only, it has zero effect on regular Google Search indexing, since Googlebot is a separate, unrelated user-agent. The honest limitation here matters: robots.txt is a request, not enforcement, well-behaved bots from major companies respect it because their reputation depends on it, but a scraper that’s already ignoring copyright isn’t going to stop because a text file asked it to. For real enforcement against bots that ignore the rules, that’s back to server or CDN-level blocking, the same Cloudflare-style protection already doing the work against hotlinking above.
Image Watermarking: How to Add Real Friction Against Theft
A watermark won’t stop a determined thief, nothing here will. What it does is create friction. An image that needs cropping or retouching before it’s usable is a worse target than a clean file sitting right there, and some portion of casual reuse simply moves on to an easier image instead. Placed over meaningful detail rather than tucked in a corner as pure branding, a watermark does more actual work.
Worth knowing about for anything you’re serious about protecting: C2PA content credentials, an embedded, cryptographically verifiable record of an image’s origin, are becoming a real standard rather than a novelty, with major platforms including Cloudflare now offering built-in tools to attach them. It’s not something every blog image needs, but it’s the direction serious provenance tracking is heading.
How to Find Stolen Images With Reverse Image Search
You can’t act on theft you don’t know about. Two free tools do the actual finding:
TinEye is generally the stronger option for exact-match theft, upload your original image and it surfaces every other site hosting that exact file.
Google Images (the camera icon in the search bar) finds visually similar images, which catches cases TinEye can miss, a cropped watermark, a resized copy, a recolored version.
How to File a DMCA Takedown for Stolen Images
A DMCA takedown is the real mechanism here, and most people send it to the wrong place. Sending a takedown notice to a site’s designer or the site itself often goes nowhere. The notice needs to go to whoever’s actually hosting the content, findable through a WHOIS lookup or by checking the site’s DNS records. If the site sits behind Cloudflare (a large share of sites do), Cloudflare will forward your notice to the actual hosting provider and disclose that provider’s identity to you as part of the process, which is often the missing link when a takedown seems to go nowhere.
Questions People Ask About Image Theft
Does disabling right-click actually stop people from stealing images?
No, not in any meaningful way. It blocks one specific method while leaving screenshots, browser dev tools, and view-source completely open. Its only real effect is that a screenshot captures a lower-resolution copy than the original, which discourages reuse where full quality matters, not real theft prevention.
What’s the difference between hotlink protection and watermarking?
Hotlink protection stops other sites from directly embedding your image file, which mainly protects your bandwidth. Watermarking doesn’t stop anyone from saving or reposting the image, it just adds friction that makes casual reuse less appealing, since the image now needs editing before it looks clean.
How do I actually find out if someone’s stolen my images?
Reverse image search. TinEye is generally stronger for exact-match theft, upload your original and it shows every site hosting that exact file. Google Images (the camera icon) catches visually similar copies, cropped, resized, or recolored versions that exact-match tools can miss.
Who do I actually send a DMCA takedown to?
Whoever is hosting the content, not the site’s designer and not the site’s contact form. A WHOIS lookup or checking DNS records identifies the real host. If the site sits behind Cloudflare, sending the notice to Cloudflare gets it forwarded to the actual host, and Cloudflare will disclose that host’s identity to you.
Is there any way to fully stop image theft?
No. Every method here reduces it or adds friction, none of them eliminate it. The realistic goal is making your images a worse target than the alternative, not building an unbreakable lock.
Should I still use a WordPress plugin to protect images?
Some can help with watermarking or hotlink protection specifically, but be cautious of anything promising to fully “prevent theft,” that’s not a real claim any plugin can deliver on. Verify a plugin is actively maintained before relying on it, since abandoned image-protection plugins are common and stop working silently.
Can I stop AI models from training on my images?
Partially. A robots.txt disallow rule for bots like GPTBot and Google-Extended signals that you don’t want your content used for AI training, and reputable companies generally honor it. It’s a request, not a lock, a scraper already ignoring copyright won’t stop because of a text file, so real enforcement against those still needs a server or CDN-level block.
Conclusion
Nothing here makes your images unstealable, and any advice claiming otherwise isn’t being honest with you. What actually works is layered friction: hotlink protection that stops the free bandwidth ride, a watermark that makes casual reuse less appealing, and the ability to actually find theft when it happens and send a takedown notice to the right place. That’s a realistic strategy. A right-click blocker that a screenshot defeats in five seconds never was.
