Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using IIS. I have few image files on my server. I want to display them on my website, but when someone finds the URL and tries to access it from the server from the browser, I want to show them Access Denied and not let them download the file.

Is this do able? If yes, how do I do it?


share|improve this question

I think what you are actually asking is how to prevent hotlinking? If so, then there are plenty of resources out there for that. Example: How to prevent image leeching (hot linking) in IIS 6.0

share|improve this answer
This is a much better method than what I suggested. – squillman Oct 13 '11 at 16:49

By allowing it to be directly loaded in a web page you, by definition, are downloading it. A completely separate request is made by your browser for the image file itself independent of the request for the web page it loads in.

You could put code in place to dynamically send image information to a page. The code could read the image files from a location outside of your document root and send the data to the page. Then there would be no URL for the image and thus it couldn't be downloaded from a browser.

The code would read the binary image data from the file and then output that same data while setting the mime-type to whatever format your image is (image/jpg, image/png, etc). This can be done via CGI, ASP, JSP, or any other kind of application gateway.


Preventing hotlinking is a better suggestion than this, though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.