With Allowed referrers on, a request whose Referer header is not on the project’s list is answered 403. Requests without a Referer (direct opens, some privacy browsers) are allowed by default so your own visitors are not blocked.
- Add each domain that embeds your images. Wildcards like *.example.com cover subdomains.
- Changes apply at the edge within about a minute.
- Staging sites need their own entry.